Implement RX event loop with wire format dispatch

Wire format module (src/wire.rs):
- Discriminator-based packet framing (0x00/0x01/0x02)
- Header parsing: EncryptedHeader, Msg1Header, Msg2Header
- Serialization: build_msg1(), build_msg2(), build_encrypted()
- 11 unit tests for parsing and roundtrip

Session index tracking:
- PeerConnection: our_index, their_index, transport_id, source_addr
- ActivePeer: noise_session, indices, transport_id, current_addr
- Removed Clone from ActivePeer (NoiseSession nonce reuse risk)
- PromotionResult refactored to use NodeId instead of ActivePeer

Node RX event loop:
- run_rx_loop() with packet_rx channel consumption
- process_packet() discriminator dispatch
- handle_encrypted_frame() with O(1) index lookup
- handle_msg1() with rate limiting and inbound handshake
- handle_msg2() completing outbound handshakes
- dispatch_link_message() stub for link protocol

Infrastructure (from Session 56):
- IndexAllocator for random 32-bit session indices
- HandshakeRateLimiter with token bucket
- ReplayWindow for 2048-packet sliding window
- Bloom filter defaults updated to v1 spec

All 265 tests pass.

src/lib.rs

@@ -8,13 +8,16 @@ pub mod cache;
 pub mod config;
 pub mod icmp;
 pub mod identity;
+pub mod index;
 pub mod noise;
 pub mod node;
 pub mod peer;
 pub mod protocol;
+pub mod rate_limit;
 pub mod transport;
 pub mod tree;
 pub mod tun;
+pub mod wire;
 
 // Re-export identity types
 pub use identity::{
@@ -66,3 +69,16 @@ pub use icmp::{build_dest_unreachable, should_send_icmp_error, DestUnreachableCo
 
 // Re-export Noise types (HandshakeState not re-exported to avoid conflict with peer::HandshakeState)
 pub use noise::{CipherState, HandshakeRole, NoiseError, NoiseSession};
+
+// Re-export index types
+pub use index::{IndexAllocator, IndexError, SessionIndex};
+
+// Re-export rate limiting types
+pub use rate_limit::{HandshakeRateLimiter, TokenBucket};
+
+// Re-export wire format types
+pub use wire::{
+    build_encrypted, build_msg1, build_msg2, EncryptedHeader, Msg1Header, Msg2Header,
+    DISCRIMINATOR_ENCRYPTED, DISCRIMINATOR_MSG1, DISCRIMINATOR_MSG2, ENCRYPTED_MIN_SIZE,
+    ENCRYPTED_OVERHEAD, MSG1_WIRE_SIZE, MSG2_WIRE_SIZE,
+};