fix(companion): guarantee dual-path peering — LAN p2p + public anchor, always

The whole point of FIPS: the phone peers with the node's npub using the
LAN endpoint as a direct p2p dial hint AND rendezvouses via a public
anchor when away — neither LAN nor 5G location may matter. The anchor
half only existed when the scanned QR carried fanchors, so pairing
against an older node left the phone LAN-only and everything died on 5G.

The Archipelago vps2 anchor (npub + 146.59.87.168:8444/tcp, lockstep
with core fips/anchors.rs) is now baked into upsertNodePeer as a
guaranteed peer. Mesh connect retry window widened so a first-ever
pairing survives the VPN consent dialog. Served APK: 0.5.3 (vc23).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/HANDOFF-2026-07-23-companion-apk-deploy.md

@@ -18,8 +18,11 @@ user's hands.
   support; web scan modal hands live scanning to it.
 - npub-keyed saved servers (pairing contract item 1, PR #106).
 - Served APK refreshed: `neode-ui/public/packages/archipelago-companion.apk`
-  is now **0.5.2 / versionCode 22**, which additionally fixes the two field
-  failures from the user's 5G test (screenshots, 21:54):
+  is now **0.5.3 / versionCode 23**. On top of the 0.5.1 scanner fixes it
+  guarantees dual-path peering — the node's LAN endpoint (direct p2p, npub-
+  keyed dial hints) AND the Archipelago public anchor (vps2, baked into the
+  app so even an old node's QR can't leave the phone LAN-only) — and fixes
+  the two field failures from the user's 5G test (screenshots, 21:54):
   - **Mesh VPN no longer kills the phone's internet** — the IPv6-only TUN
     never called `allowFamily(AF_INET)`, so Android blocked all IPv4 while
     the mesh was up. Now allowed (+ `allowBypass`).
@@ -39,9 +42,15 @@ user's hands.
 3. The demo stack gets its images from CI (run 100 pushed today with the new
    web bundle) — confirm the Portainer stack re-pulled, or trigger its
    redeploy, so the demo QR also serves vc21.
-4. Re-test the user's exact flow: node UI → Companion popup → download APK
-   via QR → install (vc21 updates vc19/vc20 in place) → scan the pairing QR.
-   If the scan still fails on-device with vc21, capture `adb logcat` around
-   the scan and report back — the parser accepts the npub-first QR
-   (`fanchors` self-anchor first), so a remaining failure would be camera-
-   hardware-specific, not format.
+4. **Node side is half the 5G story**: away-from-home reachability needs the
+   NODE connected to the public anchor too. On Framework PT (and any test
+   node): deploy current main (node-side npub-first `fips.pair-info`), then
+   verify `sudo -n fipsctl show status` reports the anchor connected —
+   `fips.reconnect` RPC if not. A phone can dial the anchor perfectly and
+   still fail if the node never enrolled with it.
+5. Re-test the user's exact flows with vc23 (updates any older install in
+   place): (a) pair ON the LAN, then switch the phone to 5G — the UI must
+   come up via the mesh ULA; (b) pair while ALREADY on 5G (never on the
+   node's LAN) — scan, VPN consent, and the connect must succeed through
+   the anchor. If either fails, capture `adb logcat` around the attempt and
+   `fipsctl show sessions` on the node, and report back.