fix(kerykeion): store-and-forward preserves payload + real stored_at_ms

[forkwright]

Summary

Store-and-forward silently discarded outbound traffic in two ways: MeshRouter::send stored an empty packet_bytes payload for offline destinations (Vec::new(), packet argument otherwise unused), and hardcoded stored_at_ms: 0 on every stored message. Together this meant a message routed to an offline node was delivered as an empty, mis-attributed shell once the node came back online, and StoreForward::prune_expired computed every message's expiry against the Unix epoch instead of its real storage time — expiring the entire store against any real wall-clock now_ms.

Closes #189
Closes #236

Changes

• MeshRouter::send: encode the real packet via prost::Message::encode_to_vec into StoredMessage.packet_bytes, and capture the live portnum from the packet's Decoded payload variant (0 for Encrypted/absent).
• MeshRouter::send: stored_at_ms is now now_ms() (real epoch milliseconds via jiff::Timestamp::now()), not a hardcoded 0.
• MeshRouter::node_came_online: rebuilds the original MeshPacket by decoding packet_bytes (MeshPacket::decode) instead of constructing a synthetic packet with from: 0, payload_variant: None, and hardcoded hop_limit/hop_start = 3. A decode failure (never expected — packet_bytes is only ever written by send on this same type) is skipped rather than delivering a garbage packet.

Testing

• cargo fmt --check passes
• cargo clippy -p kerykeion --all-targets passes (no new warnings)
• cargo nextest run -p kerykeion — 207 passed
• Full kanon gate --stamp — Gate-Passed (763 workspace tests, fmt/check/clippy/nextest/lint all PASS)
• New test store_forward_round_trips_payload_and_header_on_flush: sends a packet with a real Data payload to an unreachable node, flushes via node_came_online, and asserts the popped message has byte-identical payload plus the original from/hop_limit/hop_start (fails against the old code, which returns payload_variant: None and from: 0).
• New test store_forward_records_real_wall_clock_and_prunes_after_ttl: sends with ttl_secs: 1 using real wall-clock bounds, asserts the message survives prune_expired within its TTL and is pruned once now_ms passes stored_at_ms + ttl (fails against the old code, which prunes immediately against any real now_ms since stored_at_ms was 0).