fix(sidecar): use canonical mesh document store

[kitplummer]

Summary

• route sidecar document CRUD through peat-mesh's canonical DocumentStore contract instead of bypassing it through raw AutomergeStore calls
• retain encrypted-at-rest persistence and the existing change-event lifecycle
• elect exactly one mDNS dial initiator by endpoint ID so reciprocal discovery cannot replace the connection carrying the initial document sweep

This is the peat-node slice of defenseunicorns/peat#1004. The shared-endpoint prerequisite is defenseunicorns/peat-mesh#375.

Validation

• cargo fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace — 526 passed, 18 ignored
• cargo test --test node_test
• cargo test --test cross_peer_encryption_test -- --nocapture
• ./test/cross-cluster-sync.sh — bidirectional two-cluster convergence and CLI workflow passed; clusters cleaned up
• physical Samsung SM-X210 Android 16 ↔ ARM64 Linux validation: direct mDNS peer connection, peer count 1, and Automerge convergence in both directions

Relates to defenseunicorns/peat#1004.

[peat-bot]

Peat QA Review (SHA: 890149c)

Linked Issues

• Cross-repo reference noted, not fetched: defenseunicorns/peat#1004.
• Cross-repo reference noted, not fetched: defenseunicorns/peat-mesh#375.
• No same-repo issues were referenced with closing keywords or direct issue references.

No findings.

Validation run locally:

• cargo test --test node_test -- --nocapture passed: 25 passed.
• cargo test --test grpc_test -- --nocapture passed: 7 passed.