Switch FSP handshake from Noise XK to XX

Replace the 3-message XK handshake with XX for FSP session establishment.
XX requires no prior knowledge of the peer's static key — the responder's
identity is revealed in msg2, the initiator's in msg3.

Key changes:
- session.rs: XX initiator/responder, post-handshake identity verification
  using x-only key comparison (parity-independent for npub compatibility),
  negotiation payload in msg2/msg3 (FSP version [0,0], features=0)
- Rekey: switched from XK to XX for FSP rekey handshake
- timeout.rs: suppress msg1 resends when target peer is already promoted,
  preventing cross-connection session mismatch from duplicate handshakes
- Test template: discovery backoff 3s and handshake timeout 10s for
  faster convergence in integration tests
- Integration test timeouts restored to 45s (ping) and 60s (rekey)

Squashed commits:
- Switch FSP handshake from Noise XK to XX
- Fix integration test convergence by reducing discovery backoff
- Fix cross-connection session mismatch from msg1 resend
- Fix FSP identity verification parity mismatch

testing/static/scripts/ping-test.sh

@@ -109,7 +109,7 @@ elif [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then
     wait_for_peers fips-node-e 3 20 || true
 fi
 # Wait for FSP-level connectivity (discovery + session establishment)
-wait_for_full_connectivity 30 || true
+wait_for_full_connectivity 45 || true
 
 # Reset counters for the actual test
 PASSED=0

testing/static/scripts/rekey-test.sh

@@ -59,7 +59,7 @@ fi
 trap 'echo ""; echo "Test interrupted"; exit 130' INT
 
 # Wait times derived from rekey timer
-BASELINE_CONVERGENCE_TIMEOUT=36
+BASELINE_CONVERGENCE_TIMEOUT=60
 REKEY_SETTLE=5         # settle time after rekey for cutover to complete
 # First FMP rekey should follow shortly after the 35s interval once the mesh is
 # fully converged. Keep this bounded to preserve a meaningful scheduling check