security: sign UserProfile broadcasts (#145)

[intendednull]

Summary

• UserProfile broadcasts were wrapped in a plain Envelope with no signature, so any peer could broadcast a profile claiming any peer_id and spoof that peer's display name.
• Added willow_identity::pack_profile / unpack_profile helpers that Ed25519-sign the profile and reject it on receive unless the verified signer equals profile.peer_id.
• New typed error variant IdentityError::PeerMismatch { claimed, signer }; mismatches are rejected and logged at warn! in the listener.
• Updated both profile broadcast sites (connect.rs NeighborUp retry + broadcast_profile_via_network) and the receive path in listeners.rs.

Threat addressed

Display-name spoofing on the _willow_profiles topic. Any peer could publish a signed-looking envelope with another peer's peer_id and an arbitrary display_name, which the client would blindly store and render. With this change the receive path drops any profile whose verified Ed25519 signer does not match the claimed peer_id.

Test plan

• cargo fmt --check
• cargo clippy -p willow-identity --all-targets -- -D warnings
• cargo clippy -p willow-client --all-targets -- -D warnings
• cargo test -p willow-identity — 26 passed, including new pack_and_unpack_profile_accepts_self_signed, unpack_profile_rejects_spoofed_peer_id, unpack_profile_rejects_tampered_bytes
• cargo test -p willow-client — 74 passed
• cargo check --target wasm32-unknown-unknown -p willow-client

Closes #145