Multi-network foundation: netmgr, derived identities, additive IPC protocol

YAW/2 peer wire protocol is unchanged. Changes are local only.

internal/crypto:
- DeriveForNetwork(master, networkHash) — HKDF-SHA256 from master seed + network hash;
  same master + same network always produces the same Ed25519 keypair (stable peer ID)

internal/proto:
- NetworkInfo type (network_id, network_name, local_peer)
- NetworkID field on IpcMessage (optional; commands default to first network when absent)
- Networks []NetworkInfo on state_snapshot (additive alongside existing local_peer)
- EvtNetworkJoined / EvtNetworkLeft events

internal/netmgr (new):
- Manager holds N independent Network contexts (derived identity, mesh, store, anchor)
- Join(name) creates context, derives identity, opens per-network DB, starts anchor client
- Leave(id) / LeaveAll() cancel contexts and close stores
- Resolve(netID) returns named network, or Default() when netID is empty (backward compat)
- Fan-out: Manager.Subscribe() receives tagged events from all networks
- Network IDs are the first 8 hex chars of SHA-256("yaw2-net:"+name) — stable and short

internal/ipc:
- Run(mgr, port) replaces Run(m *mesh.Mesh, port, anchorURL, joinFn)
- Commands without network_id route to mgr.Default() (backward compat)
- state_snapshot includes Networks array; local_peer/connected_peers still populated from first network
- generate_invite, get_file_list, send_message all respect network_id routing

cmd/daemon:
- Creates netmgr.Manager instead of mesh.Mesh directly
- --join and --share-dir pass through Config
- Auto-join via mgr.Join() before IPC starts

test-network.sh:
- Fix peer_name bash bug: $() with && inside triggers set -e; use if/elif/else instead

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/crypto/crypto.go

@@ -15,6 +15,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"time"
@@ -22,6 +23,7 @@ import (
 	"filippo.io/edwards25519"
 	"golang.org/x/crypto/chacha20poly1305"
 	"golang.org/x/crypto/curve25519"
+	"golang.org/x/crypto/hkdf"
 	"golang.org/x/crypto/nacl/box"
 
 	"github.com/waste-go/internal/proto"
@@ -179,6 +181,24 @@ func SignalingOpen(b64box string, senderPub, recipientPriv *[32]byte) ([]byte, e
 	return out, nil
 }
 
+// DeriveForNetwork returns a new in-memory Identity derived from the master key
+// and the given network hash (hex). Same master + same network hash always
+// produces the same keypair, so the peer ID is stable across restarts.
+// Different networks produce different peer IDs, preventing cross-network correlation.
+func DeriveForNetwork(master *Identity, networkHash string) (*Identity, error) {
+	r := hkdf.New(sha256.New, master.privateKey[:32], []byte(networkHash), []byte("yaw2-net-identity"))
+	var seed [32]byte
+	if _, err := io.ReadFull(r, seed[:]); err != nil {
+		return nil, fmt.Errorf("deriving network identity: %w", err)
+	}
+	priv := ed25519.NewKeyFromSeed(seed[:])
+	return &Identity{
+		privateKey: priv,
+		PublicKey:  priv.Public().(ed25519.PublicKey),
+		Alias:      master.Alias,
+	}, nil
+}
+
 // ── X25519 ECDH ───────────────────────────────────────────────────────────────
 
 // EphemeralKey is an X25519 keypair used for a single session.