bloom: raise max_inbound_fpr antipoison cap from 0.05 to 0.10

The inbound FilterAnnounce FPR cap rejects filters whose false-positive
rate (fill^k) exceeds the configured maximum. On the fixed 1 KB / k=5
filter, 0.05 corresponds to fill 0.549 (~1,300 reachable entries), and
the busiest nodes' aggregates were beginning to hit that ceiling as the
mesh grew. Raise the default to 0.10 (fill 0.631, ~1,630 entries) to
restore headroom toward the fixed-filter capacity limit. A saturated or
poisoned filter is ~100% FPR and remains rejected, so the antipoison
gate is not materially weakened.

Updates the config default, the config-reference and bloom-filter
design docs, and the changelog.

src/config/node.rs

@@ -625,9 +625,12 @@ pub struct BloomConfig {
     pub update_debounce_ms: u64,
     /// Antipoison cap: reject inbound FilterAnnounce whose FPR exceeds
     /// this value (`node.bloom.max_inbound_fpr`). Valid range `(0.0, 1.0)`.
-    /// Default `0.05` ≈ fill 0.549 at k=5 ≈ ~3,200 entries on the 1KB
-    /// filter. Conceptually distinct from future autoscaling hysteresis
-    /// setpoints — same unit, different knobs.
+    /// Default `0.10` ≈ fill 0.631 at k=5 ≈ ~1,630 entries on the 1 KB
+    /// filter (Swamidass–Baldi). Raised from 0.05 so aggregates that are
+    /// legitimately near their operating ceiling are not rejected before
+    /// the network reaches the fixed-filter capacity limit; conceptually
+    /// distinct from future autoscaling hysteresis setpoints — same unit,
+    /// different knobs.
     #[serde(default = "BloomConfig::default_max_inbound_fpr")]
     pub max_inbound_fpr: f64,
 }
@@ -636,7 +639,7 @@ impl Default for BloomConfig {
     fn default() -> Self {
         Self {
             update_debounce_ms: 500,
-            max_inbound_fpr: 0.05,
+            max_inbound_fpr: 0.10,
         }
     }
 }
@@ -646,7 +649,7 @@ impl BloomConfig {
         500
     }
     fn default_max_inbound_fpr() -> f64 {
-        0.05
+        0.10
     }
 }