feat: implement ICMP Packet Too Big and TCP MSS clamping for MTU handling

Add dual-approach MTU handling to prevent TCP connections from hanging
when packets exceed the transport MTU after FIPS encapsulation.

ICMPv6 Packet Too Big:
- Generate RFC 4443 PTB messages for oversized packets at TUN outbound
- Inject back via TUN for local delivery to the application
- Per-source rate limiting (100ms interval, 10s entry expiry)
- MTU check in handle_tun_outbound before session encapsulation

TCP MSS Clamping:
- Intercept SYN packets in run_tun_reader() (outbound)
- Intercept SYN-ACK packets in TunWriter (inbound)
- Clamp MSS option to fit within effective MTU (transport - 127 overhead)
- Recalculate TCP checksum after modification

Code organization:
- ICMP, TCP MSS, and rate limiter modules in upper/ alongside existing
  protocol-specific packet handling (dns.rs, tun.rs)
- Shared FIPS_OVERHEAD constant (127 bytes) and effective_ipv6_mtu()
  function in upper/icmp.rs
- Node::effective_ipv6_mtu() delegates to the shared function
- run_tun_reader() accepts actual transport MTU from config

Example config corrections:
- UDP transport MTU set to 1472 across all configs (correct max UDP
  payload for standard Ethernet: 1500 - 20 IPv4 - 8 UDP)
- Startup logging of effective MTU and max MSS values

examples/docker-network/Dockerfile

@@ -2,10 +2,19 @@ FROM debian:bookworm-slim
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-        iproute2 iputils-ping dnsutils && \
+        iproute2 iputils-ping dnsutils openssh-client openssh-server && \
     rm -rf /var/lib/apt/lists/*
 
+# Setup SSH server with no authentication (test only!)
+RUN mkdir -p /var/run/sshd && \
+    ssh-keygen -A && \
+    sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config && \
+    sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords yes/' /etc/ssh/sshd_config && \
+    sed -i 's/UsePAM yes/UsePAM no/' /etc/ssh/sshd_config && \
+    passwd -d root
+
 COPY fips /usr/local/bin/
 RUN chmod +x /usr/local/bin/fips
 
-ENTRYPOINT ["fips", "--config", "/etc/fips/fips.yaml"]
+# Start SSH server in background, then run FIPS
+ENTRYPOINT ["/bin/bash", "-c", "/usr/sbin/sshd && exec fips --config /etc/fips/fips.yaml"]

examples/docker-network/configs/chain/node-a.yaml

@@ -20,7 +20,7 @@ dns:
 transports:
   udp:
     bind_addr: "0.0.0.0:4000"
-    mtu: 1280
+    mtu: 1472
 
 peers:
   - npub: "npub1tdwa4vjrjl33pcjdpf2t4p027nl86xrx24g4d3avg4vwvayr3g8qhd84le"

examples/docker-network/configs/chain/node-b.yaml

@@ -20,7 +20,7 @@ dns:
 transports:
   udp:
     bind_addr: "0.0.0.0:4000"
-    mtu: 1280
+    mtu: 1472
 
 peers:
   - npub: "npub1sjlh2c3x9w7kjsqg2ay080n2lff2uvt325vpan33ke34rn8l5jcqawh57m"

examples/docker-network/configs/chain/node-c.yaml

@@ -20,7 +20,7 @@ dns:
 transports:
   udp:
     bind_addr: "0.0.0.0:4000"
-    mtu: 1280
+    mtu: 1472
 
 peers:
   - npub: "npub1tdwa4vjrjl33pcjdpf2t4p027nl86xrx24g4d3avg4vwvayr3g8qhd84le"

examples/docker-network/configs/chain/node-d.yaml

@@ -20,7 +20,7 @@ dns:
 transports:
   udp:
     bind_addr: "0.0.0.0:4000"
-    mtu: 1280
+    mtu: 1472
 
 peers:
   - npub: "npub1cld9yay0u24davpu6c35l4vldrhzvaq66pcqtg9a0j2cnjrn9rtsxx2pe6"

examples/docker-network/configs/chain/node-e.yaml

@@ -20,7 +20,7 @@ dns:
 transports:
   udp:
     bind_addr: "0.0.0.0:4000"
-    mtu: 1280
+    mtu: 1472
 
 peers:
   - npub: "npub1n9lpnv0592cc2ps6nm0ca3qls642vx7yjsv35rkxqzj2vgds52sqgpverl"

examples/docker-network/configs/mesh/node-a.yaml

@@ -20,7 +20,7 @@ dns:
 transports:
   udp:
     bind_addr: "0.0.0.0:4000"
-    mtu: 1280
+    mtu: 1472
 
 peers:
   - npub: "npub1n9lpnv0592cc2ps6nm0ca3qls642vx7yjsv35rkxqzj2vgds52sqgpverl"

examples/docker-network/configs/mesh/node-b.yaml

@@ -20,7 +20,7 @@ dns:
 transports:
   udp:
     bind_addr: "0.0.0.0:4000"
-    mtu: 1280
+    mtu: 1472
 
 peers:
   - npub: "npub1cld9yay0u24davpu6c35l4vldrhzvaq66pcqtg9a0j2cnjrn9rtsxx2pe6"

examples/docker-network/configs/mesh/node-c.yaml

@@ -20,7 +20,7 @@ dns:
 transports:
   udp:
     bind_addr: "0.0.0.0:4000"
-    mtu: 1280
+    mtu: 1472
 
 peers:
   - npub: "npub1tdwa4vjrjl33pcjdpf2t4p027nl86xrx24g4d3avg4vwvayr3g8qhd84le"

examples/docker-network/configs/mesh/node-d.yaml

@@ -20,7 +20,7 @@ dns:
 transports:
   udp:
     bind_addr: "0.0.0.0:4000"
-    mtu: 1280
+    mtu: 1472
 
 peers:
   - npub: "npub1sjlh2c3x9w7kjsqg2ay080n2lff2uvt325vpan33ke34rn8l5jcqawh57m"

examples/docker-network/configs/mesh/node-e.yaml

@@ -20,7 +20,7 @@ dns:
 transports:
   udp:
     bind_addr: "0.0.0.0:4000"
-    mtu: 1280
+    mtu: 1472
 
 peers:
   - npub: "npub1sjlh2c3x9w7kjsqg2ay080n2lff2uvt325vpan33ke34rn8l5jcqawh57m"

examples/docker-network/docker-compose.yml

@@ -16,7 +16,7 @@ x-fips-common: &fips-common
     - net.ipv6.conf.all.disable_ipv6=0
   restart: "no"
   environment:
-    - RUST_LOG=info
+    - RUST_LOG=trace
 
 services:
   # ── Mesh topology ──────────────────────────────────────────────