Harden peer discovery and sync security (mDNS + auth tokens)

[RishiByte]

Confirm peer auth tokens are required before transfer, not logged in plaintext, and revocable/rotatable. Add a test for rejected connection on missing/invalid token. Document the peer auth flow in docs/ARCHITECTURE.md.