Add BLE L2CAP transport with scan-based auto-connect

BLE transport implementation using L2CAP Connection-Oriented Channels
(SeqPacket mode) via the bluer crate, behind cfg(feature = "ble").

Core transport:
- BleTransport<I> generic over BleIo trait (BluerIo prod, MockBleIo test)
- Connection pool with priority eviction (static > discovered, max 7)
- Connect-on-send via connect_inline() matching TCP behavior
- Per-connection receive loops with pool cleanup on disconnect

Discovery and probing:
- Combined scan_probe_loop using select! over scanner events and a
  BinaryHeap delay queue with per-entry random jitter (0-5s) to prevent
  herd effects when multiple nodes see the same beacon simultaneously
- Pre-handshake pubkey exchange ([0x00][pubkey:32]) for IK identity
- Cross-probe tie-breaker: smaller NodeAddr's outbound wins (same
  convention as FMP/FSP rekey dual-initiation)
- Probed peers reported to DiscoveryBuffer; pool fills through normal
  node-layer auto-connect -> send_async -> connect_inline path

Beacon management:
- Periodic advertising: 1s burst every 30s (configurable via
  beacon_interval_secs / beacon_duration_secs)
- FIPS service UUID for scan filtering

Configuration (all fields optional with defaults):
- adapter, psm, mtu, max_connections, connect_timeout_ms
- advertise, scan, auto_connect, accept_connections
- beacon_interval_secs (30), beacon_duration_secs (1)

Hardware validated with two BLE nodes:
- 2048-byte MTU, ~60-160ms RTT, zero-config auto-connect
- BLE spike tool at testing/ble/ for standalone adapter validation

42 unit tests + 4 node-level integration tests, all CI-compatible
via MockBleIo (no hardware required). tokio test-util added for
time-dependent scan/probe tests.

src/node/mod.rs

@@ -675,7 +675,7 @@ impl Node {
     /// Create transport instances from configuration.
     ///
     /// Returns a vector of TransportHandles for all configured transports.
-    fn create_transports(&mut self, packet_tx: &PacketTx) -> Vec<TransportHandle> {
+    async fn create_transports(&mut self, packet_tx: &PacketTx) -> Vec<TransportHandle> {
         let mut transports = Vec::new();
 
         // Collect UDP configs with optional names to avoid borrow conflicts
@@ -744,6 +744,47 @@ impl Node {
             transports.push(TransportHandle::Tor(tor));
         }
 
+        // Create BLE transport instances
+        #[cfg(target_os = "linux")]
+        {
+            let ble_instances: Vec<_> = self
+                .config
+                .transports
+                .ble
+                .iter()
+                .map(|(name, config)| (name.map(|s| s.to_string()), config.clone()))
+                .collect();
+
+            #[cfg(all(feature = "ble", not(test)))]
+            for (name, ble_config) in ble_instances {
+                let transport_id = self.allocate_transport_id();
+                let adapter = ble_config.adapter().to_string();
+                let mtu = ble_config.mtu();
+                match crate::transport::ble::io::BluerIo::new(&adapter, mtu).await {
+                    Ok(io) => {
+                        let mut ble = crate::transport::ble::BleTransport::new(
+                            transport_id,
+                            name,
+                            ble_config,
+                            io,
+                            packet_tx.clone(),
+                        );
+                        ble.set_local_pubkey(self.identity.pubkey().serialize());
+                        transports.push(TransportHandle::Ble(ble));
+                    }
+                    Err(e) => {
+                        tracing::warn!(adapter = %adapter, error = %e, "failed to initialize BLE adapter");
+                    }
+                }
+            }
+
+            #[cfg(any(not(feature = "ble"), test))]
+            if !ble_instances.is_empty() {
+                #[cfg(not(test))]
+                tracing::warn!("BLE transport configured but 'ble' feature not enabled at compile time");
+            }
+        }
+
         transports
     }
 
@@ -806,6 +847,46 @@ impl Node {
         Ok((transport_id, TransportAddr::from_bytes(&mac)))
     }
 
+    /// Resolve a BLE address string (`"adapter/AA:BB:CC:DD:EE:FF"`) to a
+    /// (TransportId, TransportAddr) pair by finding the BLE transport
+    /// instance matching the adapter name.
+    #[cfg(target_os = "linux")]
+    fn resolve_ble_addr(
+        &self,
+        addr_str: &str,
+    ) -> Result<(TransportId, TransportAddr), NodeError> {
+        let ta = TransportAddr::from_string(addr_str);
+        let adapter = crate::transport::ble::addr::adapter_from_addr(&ta)
+            .ok_or_else(|| {
+            NodeError::NoTransportForType(format!(
+                "invalid BLE address format '{}': expected 'adapter/mac'",
+                addr_str
+            ))
+        })?;
+
+        // Find the BLE transport for this adapter
+        let transport_id = self
+            .transports
+            .iter()
+            .find(|(_, handle)| {
+                handle.transport_type().name == "ble" && handle.is_operational()
+            })
+            .map(|(id, _)| *id)
+            .ok_or_else(|| {
+                NodeError::NoTransportForType(format!(
+                    "no operational BLE transport for adapter '{}'",
+                    adapter
+                ))
+            })?;
+
+        // Validate the address format
+        crate::transport::ble::addr::BleAddr::parse(addr_str).map_err(|e| {
+            NodeError::NoTransportForType(format!("invalid BLE address '{}': {}", addr_str, e))
+        })?;
+
+        Ok((transport_id, TransportAddr::from_string(addr_str)))
+    }
+
     // === Identity Accessors ===
 
     /// Get this node's identity.