Add host-to-npub static mapping with DNS hostname resolution

Add a HostMap that resolves human-readable hostnames to npubs,
enabling `gateway.fips` instead of the full `npub1...xyz.fips`.
Two sources populate the map: peer `alias` fields from the YAML
config and an operator-maintained hosts file at /etc/fips/hosts.

The DNS responder auto-reloads the hosts file on each request by
checking the file modification time, so operators can update
mappings without restarting the daemon.

- New src/upper/hosts.rs: HostMap, HostMapReloader, hostname
  validation, hosts file parser with auto-reload on mtime change
- DNS resolver checks host map before falling back to direct npub
- Node uses host map for peer display names
- Default hosts file added to both .deb and tarball packaging
- 26 new tests (789 total)

packaging/common/hosts

@@ -0,0 +1,22 @@
+# FIPS Hosts File
+#
+# Static hostname-to-npub mappings for .fips DNS resolution.
+# Each entry allows resolving hostname.fips to the peer's IPv6 address.
+#
+# Format: hostname npub1...
+#
+# Rules:
+#   - Lines starting with # are comments
+#   - Empty lines are ignored
+#   - Hostnames: a-z, 0-9, hyphens only; max 63 characters
+#   - One hostname and one npub per line, separated by whitespace
+#   - Duplicate hostnames: last entry wins
+#
+# Peer aliases from fips.yaml are also resolved automatically.
+# Entries here take precedence over peer aliases on conflict.
+#
+# Examples:
+#   vps-tx    npub10yffd020a4ag8zcy75f9pruq3rnghvvhd5hphl9s62zgp35s560qrksp9u
+#   vps-chi   npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98
+#
+# Changes are picked up automatically on the next DNS query.

packaging/systemd/build-tarball.sh

@@ -40,6 +40,7 @@ cp "${SCRIPT_DIR}/uninstall.sh" "${STAGING_DIR}/"
 cp "${SCRIPT_DIR}/fips.service" "${STAGING_DIR}/"
 cp "${SCRIPT_DIR}/fips-dns.service" "${STAGING_DIR}/"
 cp "${PACKAGING_DIR}/common/fips.yaml" "${STAGING_DIR}/"
+cp "${PACKAGING_DIR}/common/hosts" "${STAGING_DIR}/"
 cp "${SCRIPT_DIR}/README.install.md" "${STAGING_DIR}/"
 
 chmod +x "${STAGING_DIR}/install.sh" "${STAGING_DIR}/uninstall.sh"

packaging/systemd/install.sh

@@ -10,6 +10,7 @@
 #   /usr/local/bin/fipsctl        CLI query tool
 #   /usr/local/bin/fipstop        TUI monitor
 #   /etc/fips/fips.yaml           Configuration (preserved if exists)
+#   /etc/fips/hosts               Host-to-npub mappings (preserved if exists)
 #   /etc/systemd/system/fips.service      systemd unit
 #   /etc/systemd/system/fips-dns.service  DNS routing for .fips domain
 
@@ -73,6 +74,14 @@ else
     echo "Configuration installed to ${CONFIG_FILE}"
 fi
 
+HOSTS_FILE="${CONFIG_DIR}/hosts"
+if [ -f "${HOSTS_FILE}" ]; then
+    echo "Hosts file exists at ${HOSTS_FILE}, not overwriting."
+else
+    install -m 0644 "${SCRIPT_DIR}/hosts" "${HOSTS_FILE}"
+    echo "Hosts file installed to ${HOSTS_FILE}"
+fi
+
 # --- Install systemd unit ---
 
 was_active=false