Merge master into next after v0.3.0 release

Brings v0.3.0 release content forward into the next-branch
development line, preserves next's own version state, and updates
operator-facing version references to v0.4.0-dev.

Kept from master:
- docs/releases/release-notes-v0.2.1.md and -v0.3.0.md (cumulative
  archive of shipped releases)
- RELEASE-NOTES.md root mirror at v0.3.0 (tracks the most recent
  shipped release; will be replaced when the v0.4.0 release cycle
  begins on this line)
- CHANGELOG entries: [0.3.0] and [0.2.1] sections inserted under
  the existing Breaking and [Unreleased] sections
- All code, config, test, and documentation updates from master
  (openwrt yaml resync, doc-config IP placeholders, etc.)

Kept from next (resolved against master's release-prep changes):
- Cargo.toml / Cargo.lock at 0.4.0-dev (next's package version)
- CHANGELOG ## Breaking section (next-specific v0.4.0 wire-format
  breaking work) and the empty ## [Unreleased] block for future
  v0.4.0 non-breaking work

Updated to v0.4.0-dev for consistency with Cargo.toml:
- README badge (v0.3.0--dev -> v0.4.0--dev) and status-section
  prose, rewritten to describe v0.4.0 wire-format-breaking work
  on this branch (Noise XX unification, FMP node profiles,
  slimmer MMP, extensible bloom-filter encoding) instead of the
  v0.3.0 testing-and-polishing narrative that applied while
  v0.3.0 was unreleased
- docs/reference/cli-fips.md example version string

testing/sidecar/.env

@@ -8,6 +8,6 @@ FIPS_NSEC=e752b92aed3ac1595807f5d0eb5125589fbec0a2cfd3a2948d87ea076557deeb
 
 # Peer configuration (leave empty for standalone operation)
 FIPS_PEER_NPUB=npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98
-FIPS_PEER_ADDR=217.77.8.91:2121
+FIPS_PEER_ADDR=test-us01.fips.network:2121
 FIPS_PEER_ALIAS=vps
 FIPS_PEER_TRANSPORT=udp

testing/static/configs/topologies/mesh-public.yaml

@@ -38,7 +38,7 @@ nodes:
   # External/public node (not a Docker container)
   pub:
     npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98"
-    external_ip: "217.77.8.91"
+    external_ip: "test-us01.fips.network"
     peers: [a, b, c]
 
 # Spanning Tree Structure (rooted at node A):

testing/tor/socks5-outbound/configs/node-a.yaml.tmpl

@@ -1,6 +1,6 @@
 # FIPS Tor test node A — socks5-outbound
 #
-# Connects outbound to test-us01 (217.77.8.91:443) via Tor SOCKS5 proxy.
+# Connects outbound to test-us01 (test-us01.fips.network:443) via Tor SOCKS5 proxy.
 # Identity generated per-run to avoid mesh clashes with parallel tests.
 
 node:
@@ -24,5 +24,5 @@ peers:
     alias: "test-us01"
     addresses:
       - transport: tor
-        addr: "217.77.8.91:443"
+        addr: "test-us01.fips.network:443"
     connect_policy: auto_connect

testing/tor/socks5-outbound/configs/node-b.yaml.tmpl

@@ -1,6 +1,6 @@
 # FIPS Tor test node B — socks5-outbound
 #
-# Connects outbound to test-us01 (217.77.8.91:443) via Tor SOCKS5 proxy.
+# Connects outbound to test-us01 (test-us01.fips.network:443) via Tor SOCKS5 proxy.
 # Identity generated per-run to avoid mesh clashes with parallel tests.
 
 node:
@@ -24,5 +24,5 @@ peers:
     alias: "test-us01"
     addresses:
       - transport: tor
-        addr: "217.77.8.91:443"
+        addr: "test-us01.fips.network:443"
     connect_policy: auto_connect

testing/tor/socks5-outbound/docker-compose.yml

@@ -1,7 +1,7 @@
 # Tor transport integration test — socks5-outbound
 #
 # Topology:
-#   [fips-a] --tor/socks5--> test-us01 (217.77.8.91:443) <--tor/socks5-- [fips-b]
+#   [fips-a] --tor/socks5--> test-us01 (test-us01.fips.network:443) <--tor/socks5-- [fips-b]
 #
 # Both FIPS nodes connect outbound through a local Tor daemon's SOCKS5
 # proxy to test-us01's TCP listener. test-us01 routes between them.

testing/tor/socks5-outbound/scripts/tor-test.sh

@@ -5,7 +5,7 @@
 #   fips-a --tor/socks5--> test-us01 <--tor/socks5-- fips-b
 #
 # Both local FIPS nodes connect outbound through a local Tor daemon
-# to test-us01's TCP listener (217.77.8.91:443). Once both are peered
+# to test-us01's TCP listener (test-us01.fips.network:443). Once both are peered
 # with test-us01, traffic between fips-a and fips-b is routed through it.
 #
 # Each run generates ephemeral identities to avoid mesh clashes when