feat(fips): surface anchor connectivity + peer count in FipsStatus

Two new fields on the /rpc fips.status payload:

- authenticated_peer_count: how many FIPS peers the daemon has an
  authenticated session to right now. 0 means isolated / not on
  the mesh; >0 means traffic to any known npub can DHT-route.
- anchor_connected: true when the public anchor (fips.v0l.io,
  npub1zv58cn7…) is present in the daemon's identity cache. The
  anchor bootstraps DHT routing for general-case deployments, so
  this is the best single-value indicator the UI can show for
  "will federation traffic over FIPS work between previously-
  unknown peers?"

Implementation: fips::service::peer_connectivity_summary shells
out to `sudo -n fipsctl show peers` + `... show identity-cache`
(archipelago user already has NOPASSWD:ALL per the ISO sudoers
and live fleet nodes, confirmed). Failure returns (0, false) so
the UI degrades to "unknown" state without crashing.

Only queried when service_active — pre-onboarding / daemon-down
nodes skip the fipsctl call entirely.

UI side (FipsNetworkCard) consumes the full status JSON, so the
two new fields are available via existing prop plumbing; visual
treatment can come later.

Also fixes ISO build (commit 3e04456c wasn't sufficient): the
Dockerfile needs `cargo build --release --bins` — upstream FIPS
added a `fips-gateway` binary target, and plain `cargo build
--release` only builds the default bin list, which caused
`cargo deb --no-build` to fail hunting for the missing binary.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/archipelago/src/fips/mod.rs

@@ -82,6 +82,18 @@ pub struct FipsStatus {
     /// present; falls back to the upstream daemon's own key on legacy
     /// nodes where `/etc/fips/fips.pub` is readable.
     pub npub: Option<String>,
+    /// Number of currently authenticated FIPS peers, per
+    /// `fipsctl show peers`. 0 → isolated / anchor unreachable;
+    /// >0 → DHT routing is viable.
+    #[serde(default)]
+    pub authenticated_peer_count: u32,
+    /// True when at least one peer in the identity cache is a known
+    /// public anchor (currently `fips.v0l.io`). Anchors bootstrap DHT
+    /// routing for general-case deployments, so a red anchor status is
+    /// the top UX indicator of "FIPS traffic will probably degrade to
+    /// Tor until the anchor is reachable."
+    #[serde(default)]
+    pub anchor_connected: bool,
 }
 
 impl FipsStatus {
@@ -106,6 +118,12 @@ impl FipsStatus {
             _ => service::read_upstream_npub().await.ok().flatten(),
         };
 
+        let (authenticated_peer_count, anchor_connected) = if service_active {
+            service::peer_connectivity_summary().await
+        } else {
+            (0, false)
+        };
+
         Self {
             installed,
             version,
@@ -114,6 +132,8 @@ impl FipsStatus {
             service_active,
             key_present,
             npub,
+            authenticated_peer_count,
+            anchor_connected,
         }
     }
 }