Separate control and data logically, move WireGuard into userspace, add a CLI

Corrects the architecture on two points raised in review, while the project
is still small enough to change cheaply.

1. Control and data are separated *logically*, not physically.

The old reading — "nothing but control may ride on iroh" — threw away iroh's
whole value and would have forced the data plane to reimplement STUN, ICE and
a relay. Now both planes ride on iroh with different ALPNs and different
connections, so the data plane inherits hole punching and relay fallback,
while proto/ still knows nothing about packets and dataplane/ knows nothing
about the control protocol.

New boundary: PacketTransport / PacketLink, an authenticated unreliable
datagram channel per (network, peer, protocol). tsunagi/data/1 runs the same
membership handshake, then DataOpen/DataOpenAck, then QUIC datagrams. Only
the smaller endpoint id dials, so exactly one link exists per pair.

A plugin is handed links and never learns reachability, so the WireGuard
announcement shrank to a public key: there is no address left to lie about.

2. WireGuard now runs in userspace, on boringtun's protocol state machine.

No kernel module, no wg tool, no ip shell-out, no loopback proxy: the wgtool,
backend and bridge modules are gone. Only creating a TUN device needs
privileges, and that sits behind TunFactory, so the entire data plane —
handshake, encryption, routing, address ownership — is tested with none.

Address ownership is enforced rather than believed: outbound packets go to
the owner of the destination address, inbound packets are dropped unless
their source is the address derived for the peer that sent them.

3. A `tsunagi` binary: secret, doctor, id, up. It owns the runtime, the
logging subscriber and Ctrl-C, which the library still refuses to.

Also fixes a reference cycle where IrohTransport held Arc<Inner>, which kept
the databases open and the directory lock held after shutdown; two storage
tests caught it once the cycle existed.

81 tests pass offline with no privileges, including real IPv6 packets
crossing a real WireGuard tunnel over real iroh connections. Verified by
hand: two CLI processes forming a mesh both on loopback and via n0 discovery
using only an endpoint id.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Cargo.toml

@@ -10,7 +10,23 @@ readme = "README.md"
 keywords = ["mesh", "p2p", "iroh", "networking"]
 categories = ["network-programming"]
 
+[features]
+default = ["cli"]
+# The `tsunagi` command line binary. Library users can opt out.
+cli = ["dep:clap", "dep:tracing-subscriber", "tokio/signal", "tun-device"]
+# A real TUN device, so the WireGuard plugin can carry actual IP traffic.
+# Needs CAP_NET_ADMIN at run time; without it the plugin still runs and its
+# in-memory device can be used for tests.
+tun-device = ["dep:tun"]
+
+[[bin]]
+name = "tsunagi"
+path = "src/bin/tsunagi.rs"
+required-features = ["cli"]
+
 [dependencies]
+clap = { version = "4.5", features = ["derive", "env"], optional = true }
+tracing-subscriber = { version = "0.3", features = ["env-filter"], optional = true }
 iroh = { version = "1.2", default-features = false, features = ["tls-ring"] }
 tokio = { version = "1.53", features = ["rt", "rt-multi-thread", "sync", "time", "macros"] }
 rusqlite = { version = "0.40", features = ["bundled"] }
@@ -28,8 +44,10 @@ thiserror = "2.0"
 tracing = "0.1"
 fs4 = { version = "1.1", features = ["sync"] }
 directories = "6.0"
-x25519-dalek = { version = "3.0.0", features = ["static_secrets"] }
 netwatch = "0.19.3"
+bytes = "1.12.1"
+boringtun = { version = "0.7.1", default-features = false }
+tun = { version = "0.8", features = ["async"], optional = true }
 
 [dev-dependencies]
 tokio = { version = "1.53", features = ["rt", "rt-multi-thread", "sync", "time", "macros", "process"] }