Session 64: Complete peer authentication handshake and wire RX loop

Fix promote_connection to transfer NoiseSession, session indices,
transport ID, and source address to ActivePeer. Populate peers_by_index
during promotion for O(1) encrypted frame dispatch.

Add responder-side promotion in handle_msg1 — after sending msg2, the
responder immediately promotes to ActivePeer since Noise IK completes
in one step for the responder side.

Wire run_rx_loop into the fips binary using tokio::select with Ctrl+C
shutdown signal, so the daemon actually processes incoming packets.

Add end-to-end integration test: two nodes with real UDP sockets
perform full Noise IK handshake and bidirectional encrypted frame
exchange (266 tests, all passing).

src/bin/fips.rs

@@ -96,14 +96,23 @@ async fn main() {
 
     info!("FIPS running, press Ctrl+C to exit");
 
-    match tokio::signal::ctrl_c().await {
-        Ok(()) => info!("Shutdown signal received"),
-        Err(e) => error!("Failed to listen for shutdown signal: {}", e),
+    // Run the RX event loop until shutdown signal.
+    // stop() drops the packet channel, causing run_rx_loop to exit.
+    tokio::select! {
+        result = node.run_rx_loop() => {
+            match result {
+                Ok(()) => info!("RX loop exited"),
+                Err(e) => error!("RX loop error: {}", e),
+            }
+        }
+        _ = tokio::signal::ctrl_c() => {
+            info!("Shutdown signal received");
+        }
     }
 
     info!("FIPS shutting down");
 
-    // Stop the node (shuts down TUN, stops I/O threads)
+    // Stop the node (shuts down transports, TUN, I/O threads)
     if let Err(e) = node.stop().await {
         warn!("Error during shutdown: {}", e);
     }