e2e: AES-128-CCM encryption via BGP router (ROUTER_FLAG_ENCRYPTED), ECDH key per peer-pair from NODEINFO pubkeys, cache 8 entries

- etcp_router.h/c: new flag ROUTER_FLAG_ENCRYPTED (0x04), etcp_route_send_encrypted(), inflight/retrans/send_q support
- utun_instance.h: e2e_ctx_cache[8] — per-peer sc_context_t cache with derived session key
- topo_node.c: topo_node_sign_self() — single point for Ed25519 self-signing of NODEINFO
- topo_node.c: fix stale x25519_self_sig after address update (topo_node_sign_self call)
- nat_detection.c: fix stale x25519_self_sig after in-place socket meta modification
- test_etcp_router_unit: 5 E2E tests (basic round-trip, no NODEINFO drop, tampered, cache reuse, ENCRYPTED+SIGNED combined)
- builds clean, 70/70 tests pass

tools/chatgui/src/accountdelegate.cpp

@@ -1,4 +1,5 @@
 #include "accountdelegate.h"
+#include "flagpainter.h"
 #include "memberlistmodel.h"
 #include <QPainter>
 #include <QFont>
@@ -38,8 +39,16 @@ void AccountDelegate::paint(QPainter *painter, const QStyleOptionViewItem &optio
     if (index.data(Qt::UserRole + 2).toBool()) textColor = QColor("#4CAF50");
     painter->setPen(textColor);
 
+    uint8_t flags = (uint8_t)(index.data(Qt::UserRole + 3).toInt() & 0xFF);
+    int flagX = x;
+    if (flags) {
+        FlagPainter::draw(painter, flags, flagX, option.rect.top() + (option.rect.height() - nameFont.pixelSize()) / 2, nameFont.pixelSize());
+        flagX += nameFont.pixelSize() * ((flags & 0x01 ? 1 : 0) + (flags & 0x02 ? 1 : 0) + (flags & 0x04 ? 1 : 0))
+                 + ((__builtin_popcount(flags) - 1) * 2);
+    }
+
     QString name = index.data(Qt::DisplayRole).toString();
-    painter->drawText(QRect(x, option.rect.top() + 2, w, yMid - option.rect.top() - 2),
+    painter->drawText(QRect(flagX, option.rect.top() + 2, w - (flagX - x), yMid - option.rect.top() - 2),
                       Qt::AlignLeft | Qt::AlignBottom, name);
 
     QFont subFont = painter->font();