Authenticate peer identity (mTLS or Noise IK) — deferred from #32

Follow-up to #32, where this finding was the original [CRITICAL] item and was deferred so the other five findings could land in one focused PR. Deferred to a Beta release — this needs a design pass (TLS or Noise IK) and is not an alpha blocker.

Problem

TcpAdapter::recv (app/src/infra/network/tcp/adapter.rs:55-57) reads source_id as 16 raw bytes off the stream and trusts it as the peer's device identity. There is no TLS, no per-device certificate pinning, no challenge/signature. Any host on the LAN can impersonate any device UUID and forge handshakes, Metadata, Requests, and Transfers. This also defeats the deterministic local_id < peer_id conflict tiebreak in handle_conflict (app/src/application/state/entry_manager.rs:459) — a hostile peer just picks a UUID below ours and we always give way.

The scope-and-validation work from #32 reduces blast radius (peers can no longer push entries outside our configured sync_dirs, can no longer force oversized allocations, can no longer poison foreign version-vector axes), but it does not stop impersonation.

Why this is a separate issue

The fix needs its own design pass before code lands:

• Pick between mutual TLS with per-device certificates (Syncthing's BEP model — https://docs.syncthing.net/specs/bep-v1.html) and a Noise IK handshake with a static device key.
• Decide how device keys/certs are generated, persisted (next to device_id?), and rotated.
• Decide what gets published over mDNS for fingerprint/pubkey verification, and how a new peer is trusted (first-use auto-accept? explicit pairing?).
• Decide migration: how do existing installs upgrade without losing their peer set?
• source_id must be derived from the cryptographic identity, never read off the wire.

Blocks

This is the prerequisite for the sibling conflict-resolution issue ("Version-vector & conflict resolution can silently lose user edits") — the conflict-handling fixes there assume a trustworthy source_id.

Until this lands

Treat Synche as safe to run on a trusted LAN only. The AGENTS.md and docs/ARCHITECTURE.md updates from #32 note this explicitly.

Related: honest-peer UUID self-collision (was #45 / B10)

The honest variant of the UUID self-collision — two devices accidentally sharing a device_id (config copy, restored backup, baked-in container id) — has been split out into its own cheap standalone guard, #52, which lands before this auth work.

The malicious variant — a hostile peer claiming a UUID < ours to win the local_id < peer_id tiebreak — remains owned by this issue and becomes a cryptographic impossibility once source_id is key-derived.

Start by reading TcpAdapter::recv in app/src/infra/network/tcp/adapter.rs:55-57 and handle_conflict in app/src/application/state/entry_manager.rs:459, then review the linked Syncthing BEP specification. The design must select and document an identity-authentication approach, key or certificate lifecycle, peer trust and migration behavior. Done means source_id is derived from cryptographic identity rather than trusted from the stream, with validation covering impersonation and conflict handling.