fix: rpcauth credentials, reboot survival, system Tor for all containers

- Bitcoin RPC: switch to rpcauth (salted hash in bitcoin.conf, no plaintext
  in config or CLI). Password stable across reboots/restarts/deploys.
- Remove daily-reboot-test.sh cron on both servers
- Enable podman-restart.service for container auto-start after reboot
- System Tor: SocksPort 0.0.0.0:9050 with SocksPolicy for container access
- LND: tor.socks=host.containers.internal:9050 (system Tor, not container)
- Bitcoin: -proxy=host.containers.internal:9050 for Tor outbound
- bitcoin_rpc.rs: reads from secrets file, cached, stable credentials
- package.rs: dynamic rpc_user/rpc_pass, rpcauth hash generation
- network.rs: fix missing send_to_peer args (mesh encryption update)
- first-boot-containers.sh: rpcauth generation, system Tor config
- deploy-to-target.sh: rpcauth credentials, LND config migration
- Mesh: encrypted channel message support (ChaCha20-Poly1305 updates)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/mesh/mod.rs

@@ -73,6 +73,14 @@ pub struct MeshConfig {
     /// Steganographic encoding mode for mesh messages (Normal = disabled).
     #[serde(default)]
     pub steganography_mode: steganography::SteganographyMode,
+    /// Encrypt directed relay messages (TX, Lightning, block headers) via ratchet or shared secret.
+    /// Set to false to disable encryption for debugging or rollback.
+    #[serde(default = "default_true")]
+    pub encrypt_relay_messages: bool,
+}
+
+fn default_true() -> bool {
+    true
 }
 
 impl Default for MeshConfig {
@@ -86,6 +94,7 @@ impl Default for MeshConfig {
             mesh_only_mode: None,
             announce_block_headers: false,
             steganography_mode: steganography::SteganographyMode::Normal,
+            encrypt_relay_messages: true,
         }
     }
 }
@@ -162,11 +171,14 @@ impl MeshService {
 
         let block_header_cache = Arc::new(BlockHeaderCache::new());
         let relay_tracker = Arc::new(RelayTracker::new());
+        let session_manager = Arc::new(session::SessionManager::new(data_dir));
         let (state, _rx, cmd_rx) = MeshState::new(
             &channel_name,
             Arc::clone(&block_header_cache),
             Some(Arc::clone(&relay_tracker)),
             config.steganography_mode,
+            config.encrypt_relay_messages,
+            Arc::clone(&session_manager),
         );
 
         // Derive X25519 keys from Ed25519 identity