fix: systemd resource limits, Tor rotation transition, unwrap elimination, RPC timeouts

- I2: Add MemoryMax=4G, LimitNOFILE=65535, TasksMax=2048 to systemd service
- I3: Tor rotation keeps old service for 1h transition before cleanup
- R14: Replace .parse().unwrap() with .unwrap_or(localhost) in rate limiter
- R15: Replace 7 unwrap/expect in mesh protocol with proper error propagation
- R27: Add 10s timeouts to mesh Bitcoin RPC calls

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/tor-helper.sh

@@ -104,6 +104,34 @@ case "$ACTION_TYPE" in
     write_result '{"ok":true}'
     ;;
 
+  rename-service)
+    NAME=$(echo "$ACTION" | python3 -c "import sys,json; print(json.load(sys.stdin).get('name',''))" 2>/dev/null || echo "")
+    TIMESTAMP=$(echo "$ACTION" | python3 -c "import sys,json; print(json.load(sys.stdin).get('timestamp',''))" 2>/dev/null || echo "")
+    if [ -z "$NAME" ] || [ -z "$TIMESTAMP" ]; then
+      write_result '{"ok":false,"error":"Missing service name or timestamp"}'
+      exit 1
+    fi
+    if ! echo "$NAME" | grep -qE '^[a-zA-Z0-9_-]+$'; then
+      write_result '{"ok":false,"error":"Invalid service name"}'
+      exit 1
+    fi
+    if ! echo "$TIMESTAMP" | grep -qE '^[0-9]+$'; then
+      write_result '{"ok":false,"error":"Invalid timestamp"}'
+      exit 1
+    fi
+    OLD_SUFFIX="${NAME}_old_${TIMESTAMP}"
+    for base in /var/lib/tor /var/lib/archipelago/tor; do
+      SRC="${base}/hidden_service_${NAME}"
+      DST="${base}/hidden_service_${OLD_SUFFIX}"
+      if [ -d "$SRC" ]; then
+        mv "$SRC" "$DST"
+        log "Renamed $SRC -> $DST"
+      fi
+    done
+    rm -f "${HOSTNAMES_DIR}/${NAME}" 2>/dev/null || true
+    write_result '{"ok":true}'
+    ;;
+
   sync-hostnames)
     sync_hostnames
     write_result '{"ok":true}'