feat(us-017): P2P gossip, NAT-traversal relay node, and TLS

- packages/p2p: identity (peer_id from sha256 of RSA pubkey), TLS cert
  generation with SHA-256 fingerprint, GossipClient (WSS PubSub with
  per-topic handlers, dedup by msg_id, auto-reconnect), MdnsDiscovery
  (zeroconf optional dependency, graceful no-op fallback)
- packages/relay: new meshnet-relay package — RelayServer (asyncio +
  websockets) with gossip fanout hub, circuit relay proxy for NAT traversal,
  peer registry; meshnet-relay CLI
- packages/p2p/relay_bootstrap.json: team relay bootstrap list
- Tracker: _NodeEntry gains relay_addr, cert_fingerprint, peer_id; both
  register and heartbeat handlers read and store these optional fields
- docs/adr/0010 already written (previous commit)
- conftest.py: packages/relay added to sys.path
- 18 new tests; 115 passed total, 1 skipped (no regressions)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/tracker/meshnet_tracker/server.py

@@ -56,6 +56,7 @@ class _NodeEntry:
         "score", "vram_bytes", "ram_bytes", "quantizations",
         "benchmark_tokens_per_sec", "quantization", "managed_assignment",
         "pending_directives", "last_heartbeat", "tracker_mode",
+        "relay_addr", "cert_fingerprint", "peer_id",
     )
 
     def __init__(
@@ -76,6 +77,9 @@ class _NodeEntry:
         quantization: str | None = None,
         managed_assignment: bool = False,
         tracker_mode: bool = False,
+        relay_addr: str | None = None,
+        cert_fingerprint: str | None = None,
+        peer_id: str | None = None,
     ) -> None:
         self.node_id = node_id
         self.endpoint = endpoint
@@ -93,6 +97,9 @@ class _NodeEntry:
         self.quantization = quantization
         self.managed_assignment = managed_assignment
         self.tracker_mode = tracker_mode
+        self.relay_addr = relay_addr
+        self.cert_fingerprint = cert_fingerprint
+        self.peer_id = peer_id
         self.pending_directives: list[dict] = []
         self.last_heartbeat: float = time.monotonic()
 
@@ -607,6 +614,9 @@ class _TrackerHandler(http.server.BaseHTTPRequestHandler):
             return
 
         tracker_mode = bool(body.get("tracker_mode", False))
+        relay_addr = body.get("relay_addr") or None
+        cert_fingerprint = body.get("cert_fingerprint") or None
+        peer_id = body.get("peer_id") or None
 
         node_id = str(uuid.uuid4())
         entry = _NodeEntry(
@@ -626,6 +636,9 @@ class _TrackerHandler(http.server.BaseHTTPRequestHandler):
             quantization=quantization,
             managed_assignment=not explicit_shard,
             tracker_mode=tracker_mode,
+            relay_addr=relay_addr,
+            cert_fingerprint=cert_fingerprint,
+            peer_id=peer_id,
         )
         with server.lock:
             self._purge_expired_nodes()
@@ -643,6 +656,13 @@ class _TrackerHandler(http.server.BaseHTTPRequestHandler):
 
     def _handle_heartbeat(self, node_id: str):
         server: _TrackerHTTPServer = self.server  # type: ignore[assignment]
+        body: dict = {}
+        content_length = int(self.headers.get("Content-Length", 0))
+        if content_length > 0:
+            try:
+                body = json.loads(self.rfile.read(content_length))
+            except Exception:
+                pass
         with server.lock:
             self._purge_expired_nodes()
             entry = server.registry.get(node_id)
@@ -650,6 +670,12 @@ class _TrackerHandler(http.server.BaseHTTPRequestHandler):
                 self._send_json(404, {"error": "node not found"})
                 return
             entry.last_heartbeat = time.monotonic()
+            if body.get("relay_addr"):
+                entry.relay_addr = body["relay_addr"]
+            if body.get("cert_fingerprint"):
+                entry.cert_fingerprint = body["cert_fingerprint"]
+            if body.get("peer_id"):
+                entry.peer_id = body["peer_id"]
             _rebalance_model_locked(server, entry.model or "stub-model")
             directives = list(entry.pending_directives)
             entry.pending_directives.clear()