feat(runtime-host): add bounded peer transit

[M4n5ter]

Summary

English

Add the default-closed native primitive for Mesh cooperative transit. An endpoint can explicitly admit peers to its Circuit Relay v2 service, trust selected member relays for application streams, and connect through an approved relay after direct paths are unavailable.

Transit is bounded by fixed reservation, circuit, duration, and byte limits. Removing authority disconnects affected peers and closes live transit. This PR intentionally does not add Mesh desired-state reconciliation or UI; those remain the next M3 slices.

中文

为 Mesh cooperative transit 增加默认关闭的原生基础能力。端点可以显式允许成员使用自己的 Circuit Relay v2 服务、信任选定的成员 relay 承载应用流，并在 direct path 不可用后经获准 relay 连接。

Transit 使用固定的 reservation、circuit、时长和流量上限。撤销 authority 会断开受影响成员并关闭存量 transit。本 PR 不提前加入 Mesh desired-state reconciliation 或 UI；它们属于后续 M3 切片。

Refs #3842

Verification

English

• cargo test --locked --all-targets --all-features — 10 passed, including a real three-peer application stream through a member relay and live revocation
• cargo clippy --locked --all-targets --all-features -- -D warnings
• Runtime Host typecheck/build and focused peer native/listener/Mesh suites — 16 passed
• Release N-API build and runtime ABI smoke for transitSnapshot / configureTransit
• Runtime Host peer dependency, notice, and ASF header checks

中文

• cargo test --locked --all-targets --all-features — 10 项通过，包含真实三节点成员 relay 应用流和在线撤权
• cargo clippy --locked --all-targets --all-features -- -D warnings
• Runtime Host typecheck/build 与 peer native/listener/Mesh 定向测试 — 16 项通过
• Release N-API 构建及 transitSnapshot / configureTransit 运行时 ABI smoke
• Runtime Host peer 依赖、NOTICE 与 ASF header 检查

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex assisted with implementation and verification under the contributor's direction.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[jackwener]

I reviewed exact head 99fc779aedf69035dcad1e5170c78df6a549e07b and found no blocking issues.

The relay remains closed until an explicit allowed-peer policy is installed. Reservations and circuit sources are checked against that live policy, destination peers must hold an admitted reservation, and removing authority disconnects the affected peer so existing reservations and circuits close. Application streams accept relayed inbound connections only through the current trusted-relay set, while a policy change closes both previously trusted and newly trusted relay connections so their protocol handlers are rebuilt under the new policy. Direct and coordination paths retain priority, and application streams reuse only connections through transit relays named by the current request.

The fixed reservation, circuit, per-peer, duration, and byte limits match the pinned libp2p-relay boundary semantics. The current-main synthetic merge is clean. The complete Runtime Host suite passed locally (1,356 passed, 9 skipped), as did the focused peer tests, TypeScript build, formatting, and diff checks. The exact-head hosted test, native admission, Windows recovery, release packaging, and platform addon builds are successful. Local Rust execution was unavailable because this machine has Rust 1.95 while the crate requires 1.98; the hosted native and platform builds cover that toolchain requirement.

---

Automated review notice: This comment was posted by an automated review agent operated by WAWQAQ. It is not an independent human review and does not replace one.