feat(companion): fipssh — ssh to a mesh node by npub (Termux helper)

Verified against the fips crate source: the mesh ULA is a pure function
of the PUBLIC key — fd || sha256(x-only pubkey)[0..15] — so the npub is
the durable address and needs no resolver. Android/tools/fipssh wraps
ssh for Termux: 'fipssh user@npub1…' derives the ULA (pure-python
bech32 + sha256, checksum-validated, typo protection) and execs ssh
over the companion's split tunnel; --resolve prints the ULA alone.

The derivation is pinned by a new Rust test
(npub_derives_the_same_mesh_ula_as_the_fips_identity, 3 seeds against
fips::Identity) and the helper's output was verified byte-identical
against a live fips identity pair. SSH-over-mesh handover updated with
an addendum: node docs/UI can advertise npub-based addressing, no
node-side DNS needed for this case.

docs/HANDOFF-2026-08-31-ssh-over-mesh.md

@@ -87,6 +87,25 @@ the node UI**, default **off**. Sketch:
 - [ ] Settings UI survives a page reload; RPC has a vitest like
       `TransportPrefsCard.test.ts`.
 
+## Addendum (2026-08-31, same day): the npub IS the address
+
+While wiring this up we confirmed the mesh ULA is a **pure function of the
+public key** — `fd ‖ sha256(x-only pubkey)[0..15]` (`fips/src/identity/node_addr.rs`
+`from_pubkey` → `identity/address.rs` `from_node_addr`,
+`FIPS_ADDRESS_PREFIX = 0xfd`). The daemon's DNS resolver (`fips/dial.rs`) just
+answers what anyone can compute. Consequences for the node side:
+
+- Docs/UI can advertise `ssh <user>@npub1…`-style addressing: Termux's
+  `Android/tools/fipssh` (shipped with the companion work) derives the ULA
+  from the npub with zero infrastructure, verified byte-identical against
+  the fips crate (`archy-fips-core` test
+  `npub_derives_the_same_mesh_ula_as_the_fips_identity`).
+- If the settings toggle from this handover ever grows a "copy command"
+  affordance, `fipssh <user>@<npub>` is the natural shape (npub, not ULA —
+  it is the durable identity; the ULA follows from it).
+- No node-side DNS surface is required for the SSH case; the resolver stays
+  what it is today (the node's own peer dials).
+
 ## Working rules
 
 Same as the queue handoffs: small commits, tracker issue for this feature