e2e: AES-128-CCM encryption via BGP router (ROUTER_FLAG_ENCRYPTED), ECDH key per peer-pair from NODEINFO pubkeys, cache 8 entries

- etcp_router.h/c: new flag ROUTER_FLAG_ENCRYPTED (0x04), etcp_route_send_encrypted(), inflight/retrans/send_q support
- utun_instance.h: e2e_ctx_cache[8] — per-peer sc_context_t cache with derived session key
- topo_node.c: topo_node_sign_self() — single point for Ed25519 self-signing of NODEINFO
- topo_node.c: fix stale x25519_self_sig after address update (topo_node_sign_self call)
- nat_detection.c: fix stale x25519_self_sig after in-place socket meta modification
- test_etcp_router_unit: 5 E2E tests (basic round-trip, no NODEINFO drop, tampered, cache reuse, ENCRYPTED+SIGNED combined)
- builds clean, 70/70 tests pass

src/routing_layer/topo_node_sqlite.h

@@ -43,6 +43,9 @@ int topo_node_sqlite_channel_get(sqlite3* db, const char* channel_id,
     char* name_out, int name_sz, uint64_t* owner_node_id,
     uint8_t* x25519_pub, uint8_t* ed25519_pub, uint8_t* signature);
 
+int topo_node_sqlite_channel_get_priv(sqlite3* db, const char* channel_id,
+    uint8_t* ed25519_priv_out);
+
 int topo_node_sqlite_channel_peers_all(sqlite3* db, const char* channel_id,
     uint8_t* buf, size_t buf_sz, size_t* out_len);