Fix multi-room anchor collision via per-room derived identities

The anchor keys its clients map by peer ID. With the daemon joining one
room per trusted peer, both sessions authenticated with the same real
Ed25519 ID — the second register() overwrote the first, orphaning the
earlier room's WS connection.

Fix mirrors waste-go/internal/netmgr: derive a deterministic per-room
Ed25519 keypair from HKDF(master_private_key, room_hash). Same inputs
always produce the same derived ID; different rooms produce different
IDs. No anchor changes required.

cli/internal/crypto: add DeriveForNetwork (HKDF-SHA256, same KDF as
waste-go) so the daemon can derive stable per-room signaling identities.

cli/internal/transport: Join derives a per-room signaling identity
before calling dialSignaling. Real identity is still used for hello
verification and seal/open crypto inside the DataChannel.

pwa/src/transport/flit.ts: split PeerConn.peerId into signalingId
(anchor routing) and cryptoId (seal/open, hello). In pair-room mode
the daemon's signaling ID differs from its real ID, so connectTo and
_onFrom now use trustedPeerId as the cryptoId regardless of what the
anchor reports as the sender. offerByOrder comparison uses real IDs
(trustedPeerId ?? signalingId) so both sides agree. hello verification
now also checks the Ed25519 signature, not just the claimed ID.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cli/internal/crypto/crypto.go

@@ -8,17 +8,20 @@ package crypto
 import (
 	"crypto/ed25519"
 	"crypto/rand"
+	"crypto/sha256"
 	"crypto/sha512"
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 
 	"filippo.io/edwards25519"
 	"golang.org/x/crypto/curve25519"
+	"golang.org/x/crypto/hkdf"
 	"golang.org/x/crypto/nacl/box"
 )
 
@@ -94,6 +97,21 @@ func Verify(publicKeyHex string, data []byte, sigHex string) error {
 	return nil
 }
 
+// DeriveForNetwork returns a deterministic in-memory Identity derived from the
+// master key and the given network hash (hex). Same inputs always produce the
+// same keypair, so the peer ID is stable across restarts. Different network
+// hashes produce different peer IDs, preventing the anchor's peer-ID map from
+// colliding when the same device joins multiple rooms simultaneously.
+func DeriveForNetwork(master *Identity, networkHash string) (*Identity, error) {
+	r := hkdf.New(sha256.New, master.privateKey[:32], []byte(networkHash), []byte("yaw2-net-identity"))
+	var seed [32]byte
+	if _, err := io.ReadFull(r, seed[:]); err != nil {
+		return nil, fmt.Errorf("deriving network identity: %w", err)
+	}
+	priv := ed25519.NewKeyFromSeed(seed[:])
+	return &Identity{privateKey: priv, PublicKey: priv.Public().(ed25519.PublicKey)}, nil
+}
+
 // CurvePublicKey returns the X25519 public key derived from this Ed25519 identity.
 func (id *Identity) CurvePublicKey() *[32]byte {
 	edPoint, _ := new(edwards25519.Point).SetBytes(id.PublicKey)