Add BLE L2CAP transport with scan-based auto-connect

BLE transport implementation using L2CAP Connection-Oriented Channels
(SeqPacket mode) via the bluer crate, behind cfg(feature = "ble").

Core transport:
- BleTransport<I> generic over BleIo trait (BluerIo prod, MockBleIo test)
- Connection pool with priority eviction (static > discovered, max 7)
- Connect-on-send via connect_inline() matching TCP behavior
- Per-connection receive loops with pool cleanup on disconnect

Discovery and probing:
- Combined scan_probe_loop using select! over scanner events and a
  BinaryHeap delay queue with per-entry random jitter (0-5s) to prevent
  herd effects when multiple nodes see the same beacon simultaneously
- Pre-handshake pubkey exchange ([0x00][pubkey:32]) for IK identity
- Cross-probe tie-breaker: smaller NodeAddr's outbound wins (same
  convention as FMP/FSP rekey dual-initiation)
- Probed peers reported to DiscoveryBuffer; pool fills through normal
  node-layer auto-connect -> send_async -> connect_inline path

Beacon management:
- Periodic advertising: 1s burst every 30s (configurable via
  beacon_interval_secs / beacon_duration_secs)
- FIPS service UUID for scan filtering

Configuration (all fields optional with defaults):
- adapter, psm, mtu, max_connections, connect_timeout_ms
- advertise, scan, auto_connect, accept_connections
- beacon_interval_secs (30), beacon_duration_secs (1)

Hardware validated with two BLE nodes:
- 2048-byte MTU, ~60-160ms RTT, zero-config auto-connect
- BLE spike tool at testing/ble/ for standalone adapter validation

42 unit tests + 4 node-level integration tests, all CI-compatible
via MockBleIo (no hardware required). tokio test-util added for
time-dependent scan/probe tests.

packaging/common/fips.yaml

@@ -37,6 +37,15 @@ transports:
   #   auto_connect: true
   #   accept_connections: true
 
+  # Bluetooth Low Energy transport — requires BlueZ and the 'ble' feature.
+  # ble:
+  #   adapter: "hci0"
+  #   mtu: 2048
+  #   advertise: true
+  #   scan: true
+  #   auto_connect: true
+  #   accept_connections: true
+
 peers: []
   # Static peers for bootstrapping (UDP or TCP):
   # - npub: "npub1..."

packaging/systemd/README.install.md

@@ -62,7 +62,32 @@ transports:
     accept_connections: true
 ```
 
-### 3. Static Peers
+### 3. Bluetooth Transport
+
+If using BLE for local mesh discovery, the FIPS binary must be built with
+the `ble` feature (enabled by default). BlueZ must be installed and running:
+
+```bash
+sudo apt install bluez
+sudo systemctl enable --now bluetooth
+```
+
+Add your service user to the `bluetooth` group, or run with
+`CAP_NET_ADMIN` + `CAP_NET_RAW` capabilities.
+
+Configure BLE in the transports section:
+
+```yaml
+transports:
+  ble:
+    adapter: "hci0"
+    advertise: true
+    scan: true
+    auto_connect: true
+    accept_connections: true
+```
+
+### 4. Static Peers
 
 For bootstrapping over UDP or TCP, add known peers:
 
@@ -76,7 +101,7 @@ peers:
     connect_policy: auto_connect
 ```
 
-### 4. DNS Resolver (optional, requires systemd-resolved)
+### 5. DNS Resolver (optional, requires systemd-resolved)
 
 FIPS includes a DNS responder for `.fips` domain names (port 5354).
 On systems running `systemd-resolved`, the installer automatically enables