Separate control and data logically, move WireGuard into userspace, add a CLI

Corrects the architecture on two points raised in review, while the project
is still small enough to change cheaply.

1. Control and data are separated *logically*, not physically.

The old reading — "nothing but control may ride on iroh" — threw away iroh's
whole value and would have forced the data plane to reimplement STUN, ICE and
a relay. Now both planes ride on iroh with different ALPNs and different
connections, so the data plane inherits hole punching and relay fallback,
while proto/ still knows nothing about packets and dataplane/ knows nothing
about the control protocol.

New boundary: PacketTransport / PacketLink, an authenticated unreliable
datagram channel per (network, peer, protocol). tsunagi/data/1 runs the same
membership handshake, then DataOpen/DataOpenAck, then QUIC datagrams. Only
the smaller endpoint id dials, so exactly one link exists per pair.

A plugin is handed links and never learns reachability, so the WireGuard
announcement shrank to a public key: there is no address left to lie about.

2. WireGuard now runs in userspace, on boringtun's protocol state machine.

No kernel module, no wg tool, no ip shell-out, no loopback proxy: the wgtool,
backend and bridge modules are gone. Only creating a TUN device needs
privileges, and that sits behind TunFactory, so the entire data plane —
handshake, encryption, routing, address ownership — is tested with none.

Address ownership is enforced rather than believed: outbound packets go to
the owner of the destination address, inbound packets are dropped unless
their source is the address derived for the peer that sent them.

3. A `tsunagi` binary: secret, doctor, id, up. It owns the runtime, the
logging subscriber and Ctrl-C, which the library still refuses to.

Also fixes a reference cycle where IrohTransport held Arc<Inner>, which kept
the databases open and the directory lock held after shutdown; two storage
tests caught it once the cycle existed.

81 tests pass offline with no privileges, including real IPv6 packets
crossing a real WireGuard tunnel over real iroh connections. Verified by
hand: two CLI processes forming a mesh both on loopback and via n0 discovery
using only an endpoint id.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/protocol.md

@@ -132,6 +132,34 @@ A `Hello` naming a network this agent does not have active is rejected with
 "unknown network". Because the claim is unverified at that point, the rejection
 event does not report a network id.
 
+## The data plane protocol
+
+IP plugin packets never travel on a control connection. They use their own
+ALPN, `tsunagi/data/1`, on their own iroh connection:
+
+```text
+initiator -> responder : (the same membership handshake as above)
+initiator -> responder : DataOpen    { protocol }
+initiator <- responder : DataOpenAck { accepted, max_datagram }
+thereafter             : QUIC datagrams carrying that plugin's packets
+```
+
+The membership handshake is identical and bound to the same network, so a data
+channel cannot be opened by somebody who does not know the secret. `protocol`
+is bounded and must name a plugin the responder actually runs; otherwise the
+channel is declined, which is an ordinary outcome rather than an error.
+
+Only one side dials — the one with the smaller endpoint id — so two agents
+never open two channels for the same thing.
+
+Packets ride as QUIC **datagrams**: unreliable and unordered, which is what a
+tunnelled protocol wants, and free of the head-of-line blocking a stream would
+add. The datagram limit is what caps a plugin's MTU.
+
+Separate connections mean separate congestion control, so a saturated data
+plane cannot delay control messages, and a data plane failure cannot take the
+control plane down with it.
+
 ## Control messages
 
 After authentication, every frame is an `Envelope { network_id, message }` and