Move the hosts file module to the crate root

HostMap and its reloader serve the node's peer display names, the peer
ACL and fipsctl as well as the DNS responder, so the hosts file is a
mesh-wide concern rather than part of the host-side IPv6 plane. Move
hosts.rs whole to src/hosts.rs as a top-level public module.

ipv6tun re-exports it, so crate::upper::hosts and fips::upper::hosts
still resolve and no consumer changes. The file itself is unchanged.

Its tracing target follows the module path and becomes fips::hosts;
the changelog note on renamed targets now says so.

CHANGELOG.md

@@ -331,7 +331,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Tracing targets of the TUN adapter, DNS responder and ICMPv6 code move from
   `fips::upper::*` to `fips::ipv6tun::*`, because the module they log from is
   now `ipv6tun` (for example `fips::upper::tun` becomes `fips::ipv6tun::tun`).
-  An existing `RUST_LOG` filter naming an old target still parses and simply
+  The hosts-file loader and reloader log as `fips::hosts` rather than
+  `fips::upper::hosts`, since the hosts file is now a top-level module. An
+  existing `RUST_LOG` filter naming an old target still parses and simply
   stops matching, so the symptom is missing log lines rather than an error.
   Update `RUST_LOG` filters, journal-watch recipes and any log-scraping alert
   accordingly. The library path `fips::upper` still resolves.

src/ipv6tun/mod.rs

@@ -7,9 +7,12 @@
 
 pub mod config;
 pub mod dns;
-pub mod hosts;
 pub mod icmp;
 pub mod icmp_rate_limit;
 pub mod ipv6_shim;
 pub mod tcp_mss;
 pub mod tun;
+
+// The hosts file moved to `crate::hosts`; re-exported so `crate::upper::hosts`
+// and `fips::upper::hosts` still resolve.
+pub use crate::hosts;

src/lib.rs

@@ -14,6 +14,7 @@ pub mod config;
 pub mod control;
 #[cfg(target_os = "linux")]
 pub mod gateway;
+pub mod hosts;
 pub mod identity;
 // Declared before `node` (and named to sort there) because it carries
 // `#[macro_use]`: the tick instrumentation macro must be in scope for the