feat: mutual Realm peer handshake over TCP (0.9.11)

Exchange enrolled certificates and Ed25519 challenge signatures so
same-Realm instances can authenticate each other after discovery.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_peer_auth.c

@@ -0,0 +1,85 @@
+#define _POSIX_C_SOURCE 200809L
+#include "cst_net.h"
+#include "cst_peer.h"
+#include "cst_realm.h"
+#include "cst_test_util.h"
+
+#include <assert.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <string.h>
+
+typedef struct {
+  os_socket_t listen;
+  cst_realm_cert_t cert;
+  uint8_t sk[64];
+  uint8_t realm_pk[32];
+  int ok;
+  char remote_id[64];
+} srv_t;
+
+static void *server_main(void *p) {
+  srv_t *s = p;
+  cst_peer_session_t sess;
+  char err[128];
+  s->ok = cst_peer_accept((intptr_t)s->listen, &s->cert, s->sk, s->realm_pk,
+                          5000, &sess, err, sizeof(err)) == 0;
+  if (s->ok)
+    snprintf(s->remote_id, sizeof(s->remote_id), "%s", sess.remote.instance_id);
+  return NULL;
+}
+
+int main(void) {
+  os_net_init();
+  cst_realm_keys_t realm;
+  assert(cst_realm_generate(&realm) == 0);
+
+  cst_realm_cert_t ca, cb;
+  uint8_t sa[32], ska[64], sb[32], skb[64];
+  assert(cst_realm_enroll(&realm, "peer-a", "A", 0, &ca, sa, ska) == 0);
+  assert(cst_realm_enroll(&realm, "peer-b", "B", 0, &cb, sb, skb) == 0);
+
+  char err[128];
+  os_socket_t ls = os_net_listen("127.0.0.1", 0, err, sizeof(err));
+  assert(ls != OS_SOCKET_BAD);
+  int port = os_net_port(ls);
+  assert(port > 0);
+
+  srv_t srv = {.listen = ls, .cert = cb};
+  memcpy(srv.sk, skb, 64);
+  memcpy(srv.realm_pk, realm.pk, 32);
+  pthread_t th;
+  assert(pthread_create(&th, NULL, server_main, &srv) == 0);
+
+  cst_peer_session_t sess;
+  assert(cst_peer_dial("127.0.0.1", port, &ca, ska, realm.pk, 5000, &sess, err,
+                       sizeof(err)) == 0);
+  assert(!strcmp(sess.remote.instance_id, "peer-b"));
+  pthread_join(th, NULL);
+  assert(srv.ok);
+  assert(!strcmp(srv.remote_id, "peer-a"));
+
+  /* Foreign realm must fail. */
+  cst_realm_keys_t other;
+  assert(cst_realm_generate(&other) == 0);
+  cst_realm_cert_t cf;
+  uint8_t sf[32], skf[64];
+  assert(cst_realm_enroll(&other, "peer-f", "F", 0, &cf, sf, skf) == 0);
+  os_socket_t ls2 = os_net_listen("127.0.0.1", 0, err, sizeof(err));
+  assert(ls2 != OS_SOCKET_BAD);
+  int port2 = os_net_port(ls2);
+  srv_t srv2 = {.listen = ls2, .cert = cb};
+  memcpy(srv2.sk, skb, 64);
+  memcpy(srv2.realm_pk, realm.pk, 32);
+  assert(pthread_create(&th, NULL, server_main, &srv2) == 0);
+  assert(cst_peer_dial("127.0.0.1", port2, &cf, skf, other.pk, 3000, &sess, err,
+                       sizeof(err)) != 0);
+  pthread_join(th, NULL);
+  assert(!srv2.ok);
+
+  os_net_close(ls);
+  os_net_close(ls2);
+  os_net_cleanup();
+  puts("test_peer_auth: OK");
+  return 0;
+}