feat: DID rotation + federation peer notification (Part 3)

- node.rotate-did: generates new Ed25519 keypair, signs rotation proof
  with old key, overwrites identity files, requires password
- federation.notify-did-change: broadcasts rotation proof to all
  trusted/observer peers over Tor
- federation.peer-did-changed: receiving side verifies rotation proof
  against known pubkey before updating peer's DID
- Rate-limited: 3/600s for rotation, 5/60s for peer notification
- Signature verification uses ed25519_dalek (constant-time)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/mod.rs

@@ -116,6 +116,7 @@ const UNAUTHENTICATED_METHODS: &[&str] = &[
     // Inter-node RPC: called by federated peers over Tor, no session cookies
     "federation.peer-joined",
     "federation.peer-address-changed",
+    "federation.peer-did-changed",
     "federation.get-state",
     // Fleet telemetry ingest: called by remote nodes posting reports
     "telemetry.ingest",
@@ -483,6 +484,7 @@ impl RpcHandler {
             "node.nostr-pubkey" => self.handle_node_nostr_pubkey().await,
             "node.nostr-sign" => self.handle_node_nostr_sign(params).await,
             "node-nostr-verify-revoked" => self.handle_node_nostr_verify_revoked().await,
+            "node.rotate-did" => self.handle_node_rotate_did(params).await,
 
             // Encrypted peer handshake (NIP-44)
             "handshake.discover" => self.handle_handshake_discover().await,
@@ -643,6 +645,8 @@ impl RpcHandler {
             "federation.peer-joined" => self.handle_federation_peer_joined(params).await,
             "federation.deploy-app" => self.handle_federation_deploy_app(params).await,
             "federation.peer-address-changed" => self.handle_federation_peer_address_changed(params).await,
+            "federation.notify-did-change" => self.handle_federation_notify_did_change(params).await,
+            "federation.peer-did-changed" => self.handle_federation_peer_did_changed(params).await,
 
             // VPN & Remote Access
             "vpn.status" => self.handle_vpn_status().await,