feat(companion): embedded FIPS mesh replaces WireGuard for remote access

- Android/rust/archy-fips-core: leaf-only fips node as a JNI cdylib (fips
  pinned to the fips-native fork rev with VpnService fd support), built by
  gradle via cargo-ndk (arm64), tested on host
- ArchyVpnService: split-tunnel VpnService routing only fd00::/8 (MTU 1280,
  foreground specialUse); FipsManager handles the one-time VPN consent and
  silent auto-start — no settings surface at all
- pairing QR now fully configures the mesh: fnpub/fip/fhost/fudp/ftcp plus
  fanchors (the node's seed-anchor list, npub@addr/transport) so the phone
  can rendezvous through public anchors when the LAN endpoint is unreachable
- default seed anchors gain the two dual-transport join.fips.network test
  anchors (23.182.128.74:443/tcp, 217.77.8.91:443/tcp); anchor adverts are
  Nostr kind-37195 events
- device token rides the password field end-to-end: backend accepts tokens
  wherever it accepts the password, so scan = instant login (WebSocket auth
  + WebView form injection unchanged); token logins skip TOTP
- ServerEntry.meshIp + IPv6-bracketed URLs; WebView retries the mesh address
  on main-frame errors, auto-login and origin checks honor it
- companion v0.5.0 (versionCode 20), arm64 abiFilter; FipsNative.available
  gates everything so non-arm64 still runs as a plain companion

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/companion-pairing-qr.md

@@ -38,6 +38,7 @@ Query parameters:
 | `fip` | no       | Node's `fips0` ULA (IPv6). Once the phone is meshed, the node's UI stays reachable at `http://[<fip>]` from anywhere — this is the remote-access address (replaces the old WireGuard 10.44.0.1 flow). |
 | `fhost` | no     | Host the phone's embedded FIPS dials (same host `url` resolved to). |
 | `fudp` / `ftcp` | no | Mesh transport ports on `fhost` (currently 2121/udp and 8443/tcp). |
+| `fanchors` | no | Comma-joined `npub@host:port/transport` rendezvous anchors (the node's seed-anchor list, capped at 4). The phone peers with these too so it can route to the node via the public mesh when the direct endpoint is unreachable (away from home / NAT). |
 
 Examples the web UI actually emits:
 
@@ -71,12 +72,20 @@ Examples the web UI actually emits:
      the parse on scheme.
    - Bad/foreign QR → clear error, stay on the scan screen.
 
-## Notes / future extensions (not in v1)
+## Landed extensions (2026-07-22)
 
-- A real-node pairing **token** instead of a password (backend mints a one-time
-  token, QR carries it, app exchanges it for a session) — needs a backend RPC;
-  the `v` param exists so we can bump when this lands.
-- Optional `name` param (node display name) so the app labels the entry nicely.
+- **Device token** (`tok`) — real nodes now pair instantly; see the param table.
+  Minting replaces the previous `companion` token, so merely re-opening the pair
+  screen invalidates a previously issued token (the phone's session/remember
+  cookies keep working; a re-scan re-pairs).
+- **`name`** — the app labels the entry with the node's server name
+  ("My Archipelago" when unset).
+- **FIPS mesh params** (`fnpub`/`fip`/`fhost`/`fudp`/`ftcp`/`fanchors`) — the
+  companion app embeds a leaf-only FIPS node (Android/rust/archy-fips-core)
+  behind a split-tunnel VpnService and dials the node + rendezvous anchors on
+  scan. This replaces the WireGuard install/tunnel onboarding screens entirely;
+  remote access = the node's fips0 ULA (`fip`), which the WebView falls back to
+  automatically when the LAN address stops answering.
 
 ## Testing checklist (app side)