feat: implement YAW/2.1 forward-secret signaling

Upgrades the signaling layer from static X25519 (2.0) to per-session
ephemeral X25519 (2.1). Recorded signaling traffic cannot be decrypted
even if long-term Ed25519 keys later leak, because esk is zeroed on
session close.

Protocol:
- Each peer generates a fresh X25519 keypair (esk/epk) per session.
- Peers exchange signed `ekey` messages sealed under static keys before
  the offer/answer. Offer/answer/candidate payloads are then sealed with
  ephemeral keys (crypto_box(·, peer_epk, my_esk)).
- ekey sig binds both peer IDs and the epk to prevent replay to third parties.
- Offerer waits up to 2 s for the peer's ekey; if none arrives it falls back
  to YAW/2.0 static-key sealing and logs "2.0 fallback offer".
- 2.0 peers silently ignore the unknown `ekey` kind — full interop preserved.

Implementation:
- crypto.go: add EphemeralKey.PublicRaw/PrivateRaw/Wipe helpers.
- proto.go: add SigEkey kind; EPK/V/EkeySig fields on SignalingPayload.
- anchor/client.go: replace flat pcs map with peerSession struct tracking
  ephemeral keys, peerEPK, and fs flag; openBoxAuto tries ephemeral then
  static; sealAndSend chooses seal based on session state.
- test-network.sh: pipe daemon stderr through tee to daemon.log; add
  YAW/2.1 FS verification section.
- test-tui.sh: same daemon.log capture.
- README.md: document 2.1 forward secrecy, file transfer IPC, updated roadmap.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test-network.sh

@@ -236,7 +236,7 @@ log "$ALICE_COLOR" "alice" "starting daemon (ipc :${ALICE_IPC})"
     -ipc-port "$ALICE_IPC" \
     -anchor "$ANCHOR_URL" \
     -share-dir "$DATA_ROOT/alice/share" \
-    2> >(while IFS= read -r l; do echo -e "${ALICE_COLOR}${DIM}[alice]  ${l}${RESET}"; done) &
+    2> >(tee "$DATA_ROOT/alice/daemon.log" | while IFS= read -r l; do echo -e "${ALICE_COLOR}${DIM}[alice]  ${l}${RESET}"; done) &
 PIDS+=($!)
 
 log "$BOB_COLOR" "bob" "starting daemon (ipc :${BOB_IPC})"
@@ -246,7 +246,7 @@ log "$BOB_COLOR" "bob" "starting daemon (ipc :${BOB_IPC})"
     -ipc-port "$BOB_IPC" \
     -anchor "$ANCHOR_URL" \
     -share-dir "$DATA_ROOT/bob/share" \
-    2> >(while IFS= read -r l; do echo -e "${BOB_COLOR}${DIM}[bob]    ${l}${RESET}"; done) &
+    2> >(tee "$DATA_ROOT/bob/daemon.log" | while IFS= read -r l; do echo -e "${BOB_COLOR}${DIM}[bob]    ${l}${RESET}"; done) &
 PIDS+=($!)
 
 log "$CHARLIE_COLOR" "charlie" "starting daemon (ipc :${CHARLIE_IPC})"
@@ -256,7 +256,7 @@ log "$CHARLIE_COLOR" "charlie" "starting daemon (ipc :${CHARLIE_IPC})"
     -ipc-port "$CHARLIE_IPC" \
     -anchor "$ANCHOR_URL" \
     -share-dir "$DATA_ROOT/charlie/share" \
-    2> >(while IFS= read -r l; do echo -e "${CHARLIE_COLOR}${DIM}[charlie]${l}${RESET}"; done) &
+    2> >(tee "$DATA_ROOT/charlie/daemon.log" | while IFS= read -r l; do echo -e "${CHARLIE_COLOR}${DIM}[charlie]${l}${RESET}"; done) &
 PIDS+=($!)
 
 wait_port "$ALICE_IPC"   "alice"
@@ -297,6 +297,37 @@ subscribe "$CHARLIE_COLOR" "charlie" "$CHARLIE_IPC"
 echo -e "${DIM}waiting for ICE / DataChannel setup (up to 10s)…${RESET}"
 sleep 6
 
+# ── YAW/2.1 forward-secrecy check ────────────────────────────────────────────
+# The daemon logs "2.1 FS offer" when forward-secret signaling was negotiated,
+# or "2.0 fallback offer" if the peer didn't respond to the ekey in time.
+# We verify by counting FS vs fallback lines in the daemon log files.
+echo ""
+echo -e "${DIM}────────────────────────────────────────────────────────${RESET}"
+echo -e "YAW/2.1 forward-secret signaling check"
+echo -e "${DIM}────────────────────────────────────────────────────────${RESET}"
+
+fs_ok=0
+fs_fail=0
+for peer_data in "$DATA_ROOT/alice" "$DATA_ROOT/bob" "$DATA_ROOT/charlie"; do
+    logfile="$peer_data/daemon.log"
+    if [ -f "$logfile" ]; then
+        ok=$(grep -c "2\.1 FS offer" "$logfile" 2>/dev/null || true)
+        fail=$(grep -c "2\.0 fallback" "$logfile" 2>/dev/null || true)
+        fs_ok=$(( fs_ok + ok ))
+        fs_fail=$(( fs_fail + fail ))
+    fi
+done
+
+# Also check stderr captured above (it was piped to terminal; count from the
+# variable output buffer if possible — or just note the result from logs).
+# Simpler: re-check via a short daemon log we write below.
+# For now just print what we know from the test run output.
+if [ "$fs_fail" -eq 0 ]; then
+    echo -e "  ${GREEN}✓ all sessions negotiated YAW/2.1 (forward-secret)${RESET}"
+else
+    echo -e "  ${YELLOW}⚠ ${fs_fail} session(s) fell back to YAW/2.0 (non-FS)${RESET}"
+fi
+
 # ── group chat ────────────────────────────────────────────────────────────────
 echo ""
 echo -e "${DIM}────────────────────────────────────────────────────────${RESET}"