feat: protocol redesign with member layer, dual node paths, and recipient-based auth

[LiranCohen]

Summary

Restructures the wireguard-mesh protocol to fix CI integration test failures (#82) by adding a member layer, splitting node records, and introducing recipient-based write authorization so non-owner devices can write their own endpoint and nodeInfo records.

Closes #82.

What changed

Protocol (protocols/wireguard-mesh.json)

• Two node paths: network/node (owner-provisioned devices) and network/member/node (member-associated devices)
• Member layer: network/member records with $role: true assign the member role via the recipient field
• nodeInfo child record: device-operational data (hostname, OS, capabilities) split from the node record into a separate nodeInfo record written by the device itself
• Recipient-based write auth: { "who": "recipient", "of": "network/node" } lets devices write their own nodeInfo and endpoint records without needing a protocol role for writes
• New schemas: member.json, node-request.json, node-info.json
• Slimmed node schema: only owner-controlled fields (meshIP, allowedIPs, label, addedAt, sourceDWN)

State loading (internal/control/dwnclient.go)

• LoadState() now queries 10 record types across both node paths: network config, owner nodes, members, member nodes, relays, ACL policy, nodeInfo (both paths), endpoints (both paths)
• New WithProtocolRole option — anchor reads as author (no role), non-anchor nodes use "network/node"
• nodeRecordToNode() pulls hostname/OS/capabilities from NodeInfoData child record

Data structs (internal/control/data.go)

• New MemberRecord, NodeInfoData structs
• NodeRecord slimmed: Hostname, OS, Capabilities removed (now in Info *NodeInfoData)
• Added MemberRecordID, SourceDWN fields

Registration (internal/mesh/register.go)

• New CreateMember() and WriteNodeInfo() functions
• RegisterNode() uses NodeDID (was SelfDID), supports both network/node and network/member/node paths via MemberRecordID
• WriteEndpoint() supports both paths

CLI (cmd/meshd/main.go)

• network join redesigned: discovers pre-created node record (anchor must run peer add first), writes nodeInfo
• network create writes nodeInfo after node registration
• peer list queries both node paths
• up passes MemberRecordID and ProtocolRole to engine

Engine (internal/engine/engine.go)

• Config gains MemberRecordID and ProtocolRole fields
• makeEndpointUpdateFunc routes writes to correct protocol path based on member status

State (internal/state/state.go)

• NetworkState gains MemberRecordID and MemberDateCreated fields

Verification

go build ./...          # Zero build errors
go vet ./...            # Zero vet warnings
go test ./... -count=1 -race  # All tests pass, no data races

Integration tests (TestTwoNodeConnectivity, TestE2ERegistrationFlow) require DWN_ENDPOINT and run on push to main.