Add periodic Noise rekey with fresh DH for forward secrecy (FMP + FSP)

Implement periodic full rekey at both protocol layers using fresh DH
key exchanges. Uses the existing K-bit flag (FLAG_KEY_EPOCH /
FSP_FLAG_K) to coordinate cutover between peers.

FMP layer (IK pattern):
- ActivePeer gains rekey state: pending/previous sessions, K-bit epoch
  tracking, drain window, dampening timer
- Handshake state stored on ActivePeer with msg1 sent on existing link
- Encrypted frame handler detects K-bit flips, promotes pending
  sessions, falls back to previous session during drain
- Handshake handlers distinguish rekey from new connections using
  addr_to_link lookup with identity-based fallback
- Free all session indices (current, rekey, pending, previous) on
  peer removal

FSP layer (XK pattern):
- SessionEntry gains parallel rekey fields with XK-specific state
  for the 3-message handshake
- Route availability check before FSP rekey initiation
- Encrypted session handler adds K-bit flip detection and dual-session
  decrypt fallback
- SessionSetup/Ack/Msg3 handlers extended for rekey paths

Defense-in-depth:
- Consecutive decryption failure detector (threshold=20) triggers
  forced peer removal instead of waiting for link-dead timeout
- Identity-based rekey detection as fallback when addr_to_link
  doesn't match (e.g., TCP ephemeral ports)

Configuration: RekeyConfig with enabled flag, after_secs (default 120),
and after_messages (default 65536) thresholds.

Logging: info for successful K-bit cutover completions, warn for
failures, debug for intermediate handshake steps, trace for routine
operations (resends, drain cleanup).

Rekey lifecycle:
1. Timer/counter fires -> initiator starts new handshake
2. Old session continues handling traffic during handshake
3. Handshake completes -> initiator cuts over, flips K-bit
4. Responder sees flipped K-bit -> promotes new session
5. Both keep old session for 10s drain window
6. After drain, old session discarded

Integration test: Docker-based multi-phase test exercising both FMP
and FSP rekey with aggressive timers (35s). Verifies connectivity
across all 20 directed pairs survives two consecutive rekey cycles.
Includes rekey topology, docker-compose profile, and CI matrix entry.

Increase ping test convergence wait from 3s to 5s for CI reliability.

.github/workflows/ci.yml

@@ -145,6 +145,10 @@ jobs:
           - suite: static-chain
             type: static
             topology: chain
+          # ── Rekey integration test ──────────────────────────────────────────
+          - suite: rekey
+            type: rekey
+            topology: rekey
           # ── Chaos / stochastic scenarios ───────────────────────────────────
           - suite: chaos-smoke-10
             type: chaos
@@ -233,6 +237,48 @@ jobs:
           docker compose -f testing/static/docker-compose.yml \
             --profile ${{ matrix.topology }} down --volumes --remove-orphans
 
+      # ── Rekey integration test ──────────────────────────────────────────────
+      - name: Install binary (rekey)
+        if: matrix.type == 'rekey'
+        run: |
+          chmod +x _bin/fips _bin/fipsctl
+          cp _bin/fips    testing/static/fips
+          cp _bin/fipsctl testing/static/fipsctl
+
+      - name: Generate and inject configs (rekey)
+        if: matrix.type == 'rekey'
+        run: |
+          bash testing/static/scripts/generate-configs.sh rekey
+          bash testing/static/scripts/rekey-test.sh inject-config
+
+      - name: Build Docker images (rekey)
+        if: matrix.type == 'rekey'
+        run: |
+          docker compose -f testing/static/docker-compose.yml \
+            --profile rekey build
+
+      - name: Start containers (rekey)
+        if: matrix.type == 'rekey'
+        run: |
+          docker compose -f testing/static/docker-compose.yml \
+            --profile rekey up -d
+
+      - name: Run rekey test
+        if: matrix.type == 'rekey'
+        run: bash testing/static/scripts/rekey-test.sh
+
+      - name: Collect logs on failure (rekey)
+        if: matrix.type == 'rekey' && failure()
+        run: |
+          docker compose -f testing/static/docker-compose.yml \
+            --profile rekey logs --no-color
+
+      - name: Stop containers (rekey)
+        if: matrix.type == 'rekey' && always()
+        run: |
+          docker compose -f testing/static/docker-compose.yml \
+            --profile rekey down --volumes --remove-orphans
+
       # ── Chaos simulation ───────────────────────────────────────────────────
       - name: Install Python deps (chaos)
         if: matrix.type == 'chaos'