Hybrid coordinate warmup: CoordsWarmup message and proactive fallback

Implement hybrid coordinate cache warming strategy: piggyback coords
via CP flag when they fit within transport MTU, send standalone
CoordsWarmup (0x14) message when they don't. On CoordsRequired or
PathBroken receipt, send CoordsWarmup immediately with source-side
rate limiting (default 2s per destination, configurable).

- Add CoordsWarmup = 0x14 session message type (empty body, CP flag)
- Add send_coords_warmup() following send_session_msg() pattern
- Restructure send_session_data() to send standalone warmup before
  data packet when piggybacked coords exceed MTU
- Add immediate CoordsWarmup response in handle_coords_required()
  and handle_path_broken() with per-destination rate limiting
- Add coords_response_interval_ms config (node.session)
- Add RoutingErrorRateLimiter::with_interval() constructor
- Zero transit-path changes: existing try_warm_coord_cache() handles
  CoordsWarmup identically to CP-flagged data packets
- Update design docs (session layer, wire formats, mesh operation,
  configuration)

src/node/routing_error_rate_limit.rs

@@ -32,6 +32,15 @@ impl RoutingErrorRateLimiter {
         }
     }
 
+    /// Create a rate limiter with a custom minimum interval.
+    pub fn with_interval(min_interval: Duration) -> Self {
+        Self {
+            last_sent: HashMap::new(),
+            min_interval,
+            max_age: Duration::from_secs(10),
+        }
+    }
+
     /// Check if we should send a routing error for this destination.
     ///
     /// Returns true if enough time has passed since the last error for
@@ -135,4 +144,19 @@ mod tests {
         limiter.cleanup(Instant::now());
         assert_eq!(limiter.len(), 1);
     }
+
+    #[test]
+    fn test_with_interval_custom_rate() {
+        let mut limiter = RoutingErrorRateLimiter::with_interval(Duration::from_millis(500));
+        assert!(limiter.should_send(&addr(1)));
+        assert!(!limiter.should_send(&addr(1)));
+
+        // Still rate-limited after 200ms (would pass with default 100ms)
+        thread::sleep(Duration::from_millis(200));
+        assert!(!limiter.should_send(&addr(1)));
+
+        // Allowed after 500ms total
+        thread::sleep(Duration::from_millis(350));
+        assert!(limiter.should_send(&addr(1)));
+    }
 }