feat(fips): A3.10 — last-known-good endpoint fallback for direct peering

New fips/endpoints.rs: an npub-keyed store (<data_dir>/fips-endpoints.json)
of every endpoint a peer was last seen connected at (fipsctl show peers
transport_addr/transport_type — covers LAN, Tailscale, and WAN alike),
refreshed each anchor tick, 30-day retention.

The anchor tick now escalates LAN → last-known-good → anchor tree: any
federation peer with a fips npub that is neither currently connected nor
covered by a live LAN direct entry gets its last-known-good endpoint
re-dialed (idempotent fipsctl connect, bounded by apply()'s per-connect
cap). This productizes the hand-applied .116↔.198 Tailscale fix of
2026-07-20 and closes RC2's "no endpoint fallback" gap.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/fips/mod.rs

@@ -29,6 +29,7 @@ pub mod anchors;
 pub mod app_ports;
 pub mod config;
 pub mod dial;
+pub mod endpoints;
 pub mod iface;
 pub mod service;
 pub mod telemetry;