Add TCP transport implementation and test harness support

Implement TCP transport for FIPS enabling firewall traversal and serving
as the foundation for future Tor transport. This is the first
connection-oriented transport in the system.

Key design decisions:
- FMP header-based framing: reuses existing 4-byte FMP common prefix for
  packet boundary recovery with zero framing overhead
- Session survives TCP reconnection: Noise/MMP/FSP state bound to npub,
  not TCP connection; MMP liveness is sole authority for peer death
- Connect-on-send: fresh connection on first send, transparent reconnect
- close_connection() trait method for cross-connection deduplication cleanup

New transport files:
- src/transport/tcp/mod.rs: TcpTransport, connection pool, accept loop
- src/transport/tcp/stream.rs: FMP-aware stream reader (shared with Tor)

Modified: transport trait (close_connection), TcpConfig, TransportHandle
match arms, create_transports(), initiate_connection() for connection-
oriented links, cross-connection tie-breaker cleanup, design docs.

Tree announce loop and TCP stability fixes:
- Preserve tree announce rate-limit state across reconnection: carry
  forward last_tree_announce_sent_ms when a peer reconnects so the
  rate-limit window isn't reset to zero
- Drop oversize TCP packets at sender: pre-send MTU check returns
  MtuExceeded instead of writing to the stream, preventing receiver-side
  connection teardown and reset-reconnect cycles

Chaos harness:
- TCP transport support: tcp_edges/has_tcp/tcp_peers in SimTopology,
  transport-aware config_gen with per-edge transport type, TCP port 443,
  pure-TCP node support
- Include all non-Ethernet edges in directed_outbound()
- Fix netem/links log messages to say "IP-based" instead of "UDP"
- Add tcp-chain, tcp-only, and tcp-mesh scenario files

Static harness:
- Transport-aware config generation (get_default_transport, transport_port)
- TCP transport injection via Python post-processing
- Add tcp-chain topology and docker-compose profile

testing/static/scripts/generate-configs.sh

@@ -77,19 +77,37 @@ resolve_keys() {
     fi
 }
 
+# Get the default transport from topology file (defaults to "udp")
+get_default_transport() {
+    local topology_file="$1"
+    local transport=$(grep "^default_transport:" "$topology_file" | head -1 | sed 's/.*: *\([a-z]*\).*/\1/')
+    echo "${transport:-udp}"
+}
+
+# Get the port for a given transport type
+transport_port() {
+    local transport="$1"
+    case "$transport" in
+        tcp) echo "443" ;;
+        *)   echo "2121" ;;
+    esac
+}
+
 generate_peer_block() {
     local topology_file="$1"
     local peer_id="$2"
 
     local peer_npub="$(get_key RESOLVED_NPUB "$peer_id")"
     local peer_ip=$(get_node_attr "$topology_file" "$peer_id" "address")
+    local transport=$(get_default_transport "$topology_file")
+    local port=$(transport_port "$transport")
 
     cat <<EOF
   - npub: "$peer_npub"
     alias: "node-$peer_id"
     addresses:
-      - transport: udp
-        addr: "$peer_ip:2121"
+      - transport: $transport
+        addr: "$peer_ip:$port"
     connect_policy: auto_connect
 EOF
 }
@@ -103,7 +121,8 @@ generate_config() {
     node_npub="$(get_key RESOLVED_NPUB "$node_id")"
     local node_nsec
     node_nsec="$(get_key RESOLVED_NSEC "$node_id")"
-    local peers=$(get_peers "$topology_file" "$node_id")
+    local peers
+    peers=$(get_peers "$topology_file" "$node_id")
 
     # Generate peers section
     local peers_config=""
@@ -129,6 +148,22 @@ generate_config() {
     config="${config//\{\{PEERS\}\}/$peers_config}"
 
     echo "$config" > "$output_file"
+
+    # Post-process: inject TCP transport config for TCP topologies
+    local transport
+    transport=$(get_default_transport "$topology_file")
+    if [ "$transport" = "tcp" ]; then
+        # Add TCP transport section and remove UDP transport
+        python3 -c "
+import yaml, sys
+with open('$output_file') as f:
+    cfg = yaml.safe_load(f)
+cfg.setdefault('transports', {})['tcp'] = {'bind_addr': '0.0.0.0:443'}
+cfg.get('transports', {}).pop('udp', None)
+with open('$output_file', 'w') as f:
+    yaml.dump(cfg, f, default_flow_style=False, sort_keys=False)
+"
+    fi
 }
 
 # Key storage for bash 3.2 compatibility (using prefixed variables instead of associative arrays)