Module reorganization and clippy cleanup

Move single-consumer modules into node/:
- rate_limit.rs, wire.rs, dns.rs — exclusively used by node subsystem
- Reduces top-level lib.rs from 16 to 13 modules

Split large files into focused subdirectories:
- noise.rs (1475 lines) → noise/{mod, handshake, session, replay, tests}.rs
- tree.rs (1479 lines) → tree/{mod, coordinate, declaration, state, tests}.rs
- bloom.rs (849 lines) → bloom/{mod, filter, state, tests}.rs
- All public APIs re-exported from mod.rs, no external import changes

Remove unused rate_limit defaults:
- HANDSHAKE_TIMEOUT_SECS, MAX_PENDING_INBOUND constants
- Default constructor eliminated in favor of with_params() taking config values

Fix all clippy warnings across codebase:
- Remove .clone() on Copy types, collapse nested ifs, replace match-return-None
  with ?, remove/gate unused code, fix loop indexing, remove unnecessary casts
- Box large PeerSlot enum variants to reduce size disparity
- cargo clippy --all-targets now reports zero warnings

src/node/lifecycle.rs

@@ -5,7 +5,7 @@ use crate::peer::PeerConnection;
 use crate::protocol::{Disconnect, DisconnectReason};
 use crate::transport::{packet_channel, Link, LinkDirection, TransportAddr};
 use crate::tun::{run_tun_reader, shutdown_tun_interface, TunDevice, TunState};
-use crate::wire::build_msg1;
+use crate::node::wire::build_msg1;
 use crate::{NodeAddr, PeerIdentity};
 use std::thread;
 use std::time::Duration;
@@ -116,7 +116,7 @@ impl Node {
                 .duration_since(std::time::UNIX_EPOCH)
                 .map(|d| d.as_millis() as u64)
                 .unwrap_or(0);
-            let mut connection = PeerConnection::outbound(link_id, peer_identity.clone(), current_time_ms);
+            let mut connection = PeerConnection::outbound(link_id, peer_identity, current_time_ms);
 
             // Allocate a session index for this handshake
             let our_index = match self.index_allocator.allocate() {
@@ -319,7 +319,7 @@ impl Node {
                     let dns_channel_size = self.config.node.buffers.dns_channel;
                     let (identity_tx, identity_rx) = tokio::sync::mpsc::channel(dns_channel_size);
                     let dns_ttl = self.config.dns.ttl();
-                    let handle = tokio::spawn(crate::dns::run_dns_responder(socket, identity_tx, dns_ttl));
+                    let handle = tokio::spawn(crate::node::dns::run_dns_responder(socket, identity_tx, dns_ttl));
                     self.dns_identity_rx = Some(identity_rx);
                     self.dns_task = Some(handle);
                     info!(bind = %bind, "DNS responder started for .fips domain");