feat: implement §9 file transfer over dedicated binary DataChannels

File chunks travel over a per-transfer "f:<xid>" WebRTC DataChannel —
direct DTLS-encrypted P2P, the anchor never sees file data. Once the
initial handshake is done the anchor can disappear and transfers continue.

Key design choices:
- Receiver sends "ok" on the file DC before sender streams, eliminating
  a race where tiny files could be fully sent/closed before the receiver's
  OnMessage handler is registered (open-race §6 analogue for data DCs).
- Auto-accept: receiver accepts every incoming offer immediately.
- Download dir: per-network at <data-dir>/downloads-<netid>/.
- Backpressure: bufferedAmountLowThreshold to avoid overwhelming the DC.
- SHA-256 verified on receive; mismatches emit EvtError and discard temp file.
- IPC: send_file {peer_id, path} → offers the named file from share dir.
- EvtFileComplete {transfer_id, path} emitted on success.

IPC command: {"type":"send_file","peer_id":"<hex>","path":"<filename>"}

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/ipc/ipc.go

@@ -247,7 +247,22 @@ func handleClient(conn net.Conn, mgr *netmgr.Manager) {
 			})
 
 		case proto.CmdSendFile:
-			send(errMsg("file transfer not yet implemented"))
+			n := mgr.Resolve(cmd.NetworkID)
+			if n == nil {
+				send(errMsg("send_file: not joined to any network"))
+				continue
+			}
+			if cmd.PeerID == nil {
+				send(errMsg("send_file: peer_id is required"))
+				continue
+			}
+			if cmd.Path == "" {
+				send(errMsg("send_file: path is required"))
+				continue
+			}
+			if err := n.Mesh.OfferFile(*cmd.PeerID, cmd.Path); err != nil {
+				send(errMsg(fmt.Sprintf("send_file: %v", err)))
+			}
 
 		default:
 			send(errMsg(fmt.Sprintf("unknown command: %s", cmd.Type)))