feat: implement circuit-v2 client transport for relayed connections

[adust09]

Closes #266. Unblocks #258.

Problem

A relayed peer could never become a Connection. The client-side relay exchanges returned a bare StreamIO that nothing upgraded, no Transport accepted a p2p-circuit multiaddr, and registerRelayStopHandler handed the raw stop stream to an application callback with no security handshake.

That blocks #258: every acceptance criterion there that distinguishes a direct connection from a relay connection presupposes a relayed Connection in swConnPool.

Spec

specs/relay/circuit-v2: once the hop / stop CONNECT exchange succeeds, "the original stream becomes the relayed connection", which clients upgrade "with a security protocol and a multiplexer, just like they would e.g. upgrade a TCP connection".

Change

New LibP2P.NAT.Relay.Transport:

• Dial — reach the relay, negotiate hop, send CONNECT, return the stream as a RawConnection. dialNewInner then runs the existing upgradeOutbound, so Noise + Yamux apply unchanged.
• Listen — transportListen on <relayAddr>/p2p/<relay>/p2p-circuit makes the reservation and exposes inbound stop streams through listenerAccept. They flow into Switch.Listen.handleInbound, so gating, upgrade, resource limits, pooling, notifiers and teardown all apply without new code. listenerAddr reports the reservation address, which puts the circuit address into switchListenAddrs for Identify to advertise.
• Identification — a relayed connection is one whose connRemoteAddr contains p2p-circuit (existing Relay.isRelayedAddr). Connection gains no new field, so the address stays the single source of truth.

registerNATHandlers now registers the transport and returns (RelayState, CircuitState).

Breaking change

NATConfig.ncOnRelayedStream is removed. The stop stream is now a connection, not an application-owned stream, so there is nothing left for that callback to own. registerNATHandlers returns a tuple.

Tests

LibP2P.NAT.Relay.TransportSpec — address parsing and transportCanDial in isolation, plus four end-to-end tests over three in-process switches on loopback TCP (relay R, target B reserving on R, dialer A):

• B's reservation address is advertised as a circuit listen address
• A's dial through the circuit yields an upgraded Connection to B, and B sees the matching inbound relayed connection
• a ping round-trips over the relayed connection
• a dial to a target holding no reservation fails

RegistrationSpec's raw-byte bridging test is replaced by the above, which exercises the same path plus the security and muxer upgrade. Full suite: 1145 examples, 0 failures.

Deliberately not in scope

• Reservation refresh before expiry — relay: refresh client reservations before expiry #268
• Enforcing the relay's advertised data/duration limits — relay: enforce client-side circuit limits (data/duration) #269
• DCUtR production integration — dcutr: production integration reuses the relay connection instead of dialing direct #258