Fix documentation drift from recent feature additions

Update 9 documentation files to match current implementation:
- Add missing rekey config section (node.rekey.*) and host mapping
  section to fips-configuration.md
- Update Ethernet frame format from [type:1][payload] to
  [type:1][length:2 LE][payload] in wire-formats and transport docs
- Fix Ethernet effective MTU from interface-1 to interface-3
- Mark rekey as Implemented in mesh-layer and session-layer status tables
- Change TCP default port examples from 443 to 8443
- Add rekey, persistent identity, host mapping, mesh size estimation to
  README features and status sections
- Update chaos scenario count from 16 to 20, add rekey topology to
  static test docs

testing/README.md

@@ -17,16 +17,18 @@ configurations.
 | mesh        | 5     | UDP       | Sparse mesh, 6 links, multi-hop  |
 | chain       | 5     | UDP       | Linear chain, max 4-hop paths    |
 | mesh-public | 5+1   | UDP       | Mesh with external public node   |
-| tcp-chain   | 3     | TCP       | Linear chain over TCP (port 443) |
+| tcp-chain   | 3     | TCP       | Linear chain over TCP (port 8443) |
+| rekey       | 5     | UDP       | Rekey integration test topology  |
 
 ### [chaos/](chaos/) -- Stochastic Simulation
 
 Automated network testing with configurable node counts, topology
 algorithms (random geometric, Erdos-Renyi, chain, explicit), and fault
 injection (netem mutation, link flaps, traffic generation, node
-churn). 16 scenarios covering general stress testing, cost-based parent
-selection, mixed link technologies (fiber/Bluetooth/WiFi), and
-transport-specific validation (UDP, TCP, Ethernet). Scenarios are
+churn). 20 scenarios covering general stress testing, cost-based parent
+selection, mixed link technologies (fiber/Bluetooth/WiFi),
+transport-specific validation (UDP, TCP, Ethernet), and ECN/congestion
+testing. Scenarios are
 defined in YAML and executed via a Python harness that manages the full
 lifecycle: topology generation, Docker orchestration, fault scheduling,
 log collection, and analysis.

testing/chaos/README.md

@@ -96,7 +96,7 @@ Explicit topologies exercising non-UDP transports.
   via beacons, not static config. Minimal netem (1-5ms delay).
 - **ethernet-mesh**: Mirrors `tcp-mesh` topology but with Ethernet instead of
   TCP. UDP edges use static config; Ethernet edges use beacon discovery.
-- **tcp-only**: 4-node ring using TCP on port 443. Tests connect-on-send,
+- **tcp-only**: 4-node ring using TCP on port 8443. Tests connect-on-send,
   FMP framing over TCP, and reconnection. Netem enabled (1-10ms delay, 0-1%
   loss).
 - **tcp-chain**: 4-node linear chain, all TCP. Tests multi-hop routing over

testing/static/README.md

@@ -90,14 +90,20 @@ appear in the topology file so that Docker nodes can peer with them.
 
 ### TCP Chain
 
-Three nodes in a linear chain using TCP transport (port 443) instead of
+Three nodes in a linear chain using TCP transport (port 8443) instead of
 UDP: A -- B -- C. Each node peers only with its immediate neighbors.
 Tests basic TCP transport connectivity and multi-hop routing over TCP.
 
 The topology file sets `default_transport: tcp`, which causes config
-generation to use TCP peer addresses (port 443), inject the TCP transport
+generation to use TCP peer addresses (port 8443), inject the TCP transport
 section, and remove the UDP transport section.
 
+### Rekey
+
+Same sparse mesh as the mesh topology (5 nodes, 6 links). Configs are
+post-processed to use aggressive rekey timers (35s) for CI testing. The
+`rekey-test.sh` script handles config injection and multi-phase verification.
+
 ## Configuration Management
 
 ### File Structure
@@ -114,7 +120,8 @@ testing/static/
 │       ├── mesh.yaml                   # Mesh topology definition
 │       ├── chain.yaml                  # Chain topology definition
 │       ├── mesh-public.yaml            # Mesh + external public node
-│       └── tcp-chain.yaml             # TCP chain (3 nodes, port 443)
+│       ├── tcp-chain.yaml             # TCP chain (3 nodes, port 8443)
+│       └── rekey.yaml                 # Rekey integration test (5 nodes)
 ├── generated-configs/                  # Auto-generated (gitignored)
 │   ├── npubs.env                       # NPUB_A=..., NPUB_B=..., etc.
 │   ├── mesh/
@@ -319,7 +326,7 @@ removing rules first.
 - **Capabilities**: `CAP_NET_ADMIN` (for TUN device creation)
 - **Devices**: `/dev/net/tun` mapped into each container
 - **DNS**: FIPS built-in resolver on `127.0.0.1:53`
-- **Transport**: UDP on port 2121 (MTU 1472) or TCP on port 443
+- **Transport**: UDP on port 2121 (MTU 1472) or TCP on port 8443
 - **TUN**: `fips0` interface, MTU 1280
 
 Each node resolves `<npub>.fips` DNS names to FIPS IPv6 addresses via its