feat(credential): implement credential peer auth and trust propagation (#1968)

- add credential manager and RPC/CLI for generate/list/revoke
- support credential-based Noise authentication and revocation handling
- propagate trusted credential metadata through OSPF route sync
- classify direct peers by auth level in session maintenance
- normalize sender credential flag for legacy non-secure compatibility
- add unit/integration tests for credential join, relay and revocation

easytier/src/peers/peer_session.rs

@@ -787,7 +787,15 @@ impl PeerSession {
         let encryptor = self
             .get_encryptor(epoch, dir, true)
             .ok_or_else(|| anyhow!("no key for epoch"))?;
-        let _ = encryptor.encrypt_with_nonce(pkt, Some(nonce_bytes.as_slice()));
+        if let Err(e) = encryptor.encrypt_with_nonce(pkt, Some(nonce_bytes.as_slice())) {
+            tracing::warn!(
+                peer_id = ?self.peer_id,
+                ?e,
+                "session encrypt failed, invalidating"
+            );
+            self.invalidate();
+            return Err(e.into());
+        }
         Ok(())
     }