chore(open-source): sanitize real infra identifiers; tighten .gitignore

Open-source readiness plan, Phase 1 items 3 and 5.

Item 3 turned out to be far narrower than the plan's "93 files" once each hit
was classified rather than bulk-replaced. Sanitized only genuine operator
identifiers:

- FIPS test fixtures and a pine_ha comment carried real node LAN addresses ->
  RFC 5737 TEST-NET-1, the convention already used elsewhere in this repo.
- Real tailnet addresses in fips/endpoints.rs, mock-backend.js and the mesh
  test runner -> the base of the CGNAT range, obviously synthetic.
- Incident comments in appgate/mod.rs and apps/fedimint/manifest.yml named a
  specific node; the role is what carries the meaning, so the address is gone.
- CHANGELOG.md held five real addresses in published release notes — the most
  exposed of the lot.

Deliberately NOT touched, because the plan's item-3 list is over-broad and
following it literally would break working code:

- 192.168.1.1 / .254, 192.168.0.0/16 and 100.64.0.0/10 are generic router
  defaults, RFC1918 classification in backup_rpc, and CGNAT range logic in
  pine_ha / CompanionIntroOverlay. Not leaked infra.
- `tx1138` is listed as a hostname to scrub but is two live things: the
  user-facing default block explorer (`DEFAULT_TX_EXPLORER`) and
  `RETIRED_TX1138_HOST`, the migration constant whose entire job is stripping
  that retired registry from existing nodes' saved mirror lists. Scrubbing
  either breaks a feature. The plan needs this correction.
- Android's `192.168.1.100` strings are UI placeholder text.

Item 5: added *.key, *.pem, id_rsa*, *.sqlite, *.db to .gitignore, with a
negation for core/archipelago/src/appgate/testdata/*.key. Checked those first —
they are documented throwaway TLS fixtures compiled in via include_bytes!, not
node identity — and the negation stops the new rule silently dropping them if
they are ever regenerated. Verified both directions: fixtures not ignored, a
stray key elsewhere caught.

Verified: residual grep for real infra addresses is clean; audit-secrets.sh
still 5/5; app-catalog drift 0 (the fedimint edit is a YAML comment, which does
not survive parsing into the signed catalog); 44/44 fips tests pass with the
rewritten assertion fixtures.

Note: these test runs shared the working tree with another agent's in-flight
LND work, which was present but unstaged and is not part of this commit.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/package/pine_ha.rs

@@ -725,7 +725,7 @@ async fn seed_assist_pipeline(storage: &std::path::Path, claude_entity: Option<&
 /// HA's zeroconf discovery stores a satellite as a fixed LAN IP. DHCP
 /// renumbering — or the whole node moving to a different network — strands
 /// the entry and the speaker silently drops (a test node 2026-07-23: entry
-/// pinned to 192.0.2.16 while the LAN had become 192.168.63.0/24). HA
+/// pinned to 192.0.2.16 while the LAN had become 192.0.2.0/24). HA
 /// never re-resolves on its own. This keeper probes each satellite entry and,
 /// when one stops answering, sweeps the node's local /24s for the same
 /// Wyoming port and rewrites the entry to the address that answers.

core/archipelago/src/appgate/mod.rs

@@ -773,7 +773,7 @@ button:active {{ transform:translateY(1px); }}
         // NOT X-Frame-Options: DENY. My Apps opens an app in an embedded
         // frame, so a blanket DENY made every gated app render as "app is
         // not responding" the moment the gate challenged it (reported on
-        // 100.82.34.38, 2026-08-05). frame-ancestors is the modern control
+        // a fleet node, 2026-08-05). frame-ancestors is the modern control
         // and can be precise: only pages from this same node may frame the
         // login, on any port or scheme, which is exactly the dashboard.
         // Anything else — another site embedding it to harvest the node
@@ -904,7 +904,7 @@ mod tests {
 
     /// The challenge must be framable by this node's own dashboard — My Apps
     /// opens apps in an embedded frame, and a blanket `X-Frame-Options: DENY`
-    /// turned every gated app into "app is not responding" (100.82.34.38,
+    /// turned every gated app into "app is not responding" (observed on a fleet node,
     /// 2026-08-05). It must still be uncacheable, and still refuse to be
     /// framed by a foreign origin, which `frame-ancestors` expresses and
     /// `X-Frame-Options` cannot.

core/archipelago/src/fips/anchors.rs

@@ -477,19 +477,19 @@ mod tests {
     fn lan_fips_anchors_builds_direct_entry() {
         let peer = crate::transport::PeerRecord {
             did: "did:key:zpeer".to_string(),
-            lan_address: Some("192.168.63.198:5678".to_string()),
+            lan_address: Some("192.0.2.198:5678".to_string()),
             fips_npub: Some("npub1peer".to_string()),
             ..Default::default()
         };
         let out = lan_fips_anchors(&[peer]);
         assert_eq!(out.len(), 1);
-        assert_eq!(out[0].address, format!("192.168.63.198:{FIPS_UDP_PORT}"));
+        assert_eq!(out[0].address, format!("192.0.2.198:{FIPS_UDP_PORT}"));
         assert_eq!(out[0].transport, "udp");
 
         // Peers missing either the LAN address or the npub produce nothing.
         let no_npub = crate::transport::PeerRecord {
             did: "did:key:zother".to_string(),
-            lan_address: Some("192.168.63.199:5678".to_string()),
+            lan_address: Some("192.0.2.199:5678".to_string()),
             ..Default::default()
         };
         assert!(lan_fips_anchors(&[no_npub]).is_empty());

core/archipelago/src/fips/endpoints.rs

@@ -153,11 +153,11 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let connected = vec![ConnectedPeer {
             npub: "npub1aaa".into(),
-            address: "100.114.134.21:2121".into(),
+            address: "100.64.0.21:2121".into(),
             transport: "udp".into(),
         }];
         let map = record_connected(dir.path(), &connected).await;
-        assert_eq!(map["npub1aaa"].address, "100.114.134.21:2121");
+        assert_eq!(map["npub1aaa"].address, "100.64.0.21:2121");
         let reloaded = load(dir.path()).await;
         assert_eq!(reloaded, map);
     }
@@ -192,7 +192,7 @@ mod tests {
         let connected = vec!["npub1conn".to_string()];
         let lan = vec![SeedAnchor {
             npub: "npub1lan".into(),
-            address: "192.168.63.198:2121".into(),
+            address: "192.0.2.198:2121".into(),
             transport: "udp".into(),
             label: "LAN".into(),
         }];