fix(fips): P0 uptime fixes — open peer port 5679, allow /blob+/dwn, fix LAN anchor port, un-deaden direct peering, fast-fail budgets

Phase A1 of docs/FIPS-UPTIME-AND-UI-STATE-PLAN.md — the five changes that
made FIPS fall back to Tor even when a FIPS path existed:

- RC0: the fips.d drop-in now opens PEER_PORT 5679 (was 80+8443 only, so
  every hardened node firewalled peers' FIPS dials; 28k drops on .198)
- RC4: /blob/ and /dwn/ added to the peer-path allowlist — mesh file
  sharing and DWN sync were 404 → 100% Tor by construction
- RC2-G2: lan_fips_anchors dials PUBLISHED_UDP_PORT (2121) instead of the
  dead 8668, with a drift-guard test against the rendered daemon config
- RC2-G1: direct LAN peering actually runs now — mDNS TXT advertises the
  FIPS npub, discovery calls set_fips_npub, and the anchor tick hydrates
  npubs from federation storage for peers on older builds
- RC3: FIPS attempt budget is a hard cap (retry no longer doubles it) and
  the 12 hot call sites get explicit fips_timeout fast-fail so Tor keeps
  its full budget (browse-peer, preview, /blob, DWN, node-message,
  rotation notifies)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/fips/config.rs

@@ -240,11 +240,21 @@ pub async fn install(identity_dir: &Path) -> Result<()> {
     // framework-pt). Ship the allowance as a fips.d drop-in on every
     // install/upgrade so no node ever regresses to a UI-less mesh.
     sudo_install_dir("/etc/fips/fips.d").await?;
-    let dropin = "# Written by archipelago on every daemon config install.\n\
-                  # Allows the web UI + peer API through the fips0\n\
-                  # default-deny inbound baseline (fips.nft).\n\
-                  tcp dport 80 accept\n\
-                  tcp dport 8443 accept\n";
+    // PEER_PORT (5679) carries ALL federation sync, cloud browse/download,
+    // mesh envelopes, DWN and invoices. It was missing from this allowlist
+    // while the comment claimed "web UI + peer API" — so every hardened
+    // node silently dropped peers' FIPS dials at the firewall and the whole
+    // fleet fell back to Tor (root-caused live 2026-07-27: 28k drops on
+    // .198's counter; :5679 answered in 0.35s once the rule was inserted).
+    let dropin = format!(
+        "# Written by archipelago on every daemon config install.\n\
+         # Allows the web UI + peer API through the fips0\n\
+         # default-deny inbound baseline (fips.nft).\n\
+         tcp dport 80 accept\n\
+         tcp dport 8443 accept\n\
+         tcp dport {peer_port} accept\n",
+        peer_port = crate::fips::dial::PEER_PORT
+    );
     let nft_stage = std::env::temp_dir().join(format!("fips-webui-{}.nft", std::process::id()));
     tokio::fs::write(&nft_stage, dropin)
         .await