feat(p2p-08): add runtime policy sync (#671)

[jlon]

Summary

• Add master-driven runtime policy sync for peer and tenant allowlists.
• Support startup and periodic refresh, signed updates, and version 0 rollback to local config.

Design

• Expose policy through a dedicated GetP2pPolicy RPC instead of coupling it to unrelated metadata paths.
• Serialize runtime updates behind a service lock and verify signatures before applying newer policy versions.

Implementation

• Add client policy fetch/sync flow in FsClient, FsContext, and P2pService.
• Add master policy RPC handling, signed policy generation from master config, and tenant-aware publish/fetch gating.

Verification

• cargo test -p curvine-client signed_runtime_policy_updates_effective_tenant_whitelist
• cargo test -p curvine-client runtime_policy_version_zero_restores_local_whitelist
• cargo test -p curvine-server p2p_runtime_policy_uses_master_config_and_signing_key

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.