Replicated repos' blocks are in IPFS but weren't queryable via standard
atproto endpoints. This adds an IpfsReadableBlockstore adapter and
ReplicatedRepoReader service that loads ReadableRepo instances on demand,
making getRecord, listRecords, and describeRepo work for replicated DIDs.

Also fixes rev extraction: syncDid() now decodes the commit block CBOR to
get the actual TID rev (instead of storing the root CID as rev), and stores
both root_cid and rev separately in replication_state.

Splits IpfsService into two narrow interfaces (BlockStore for storage, NetworkService
for P2P networking) so consumers depend only on what they need. Eases future transport
migrations (e.g. Iroh, Hyperswarm) without touching storage or verification code.

Implements content-addressed verification via RASL endpoints to prove
remote peers actually host the blocks they claim to serve. Tracks
replicated block CIDs per-DID and runs verification on a separate timer.

Implement the core replication loop: announce, discover, replicate. Nodes
publish AT Protocol records declaring their IPFS PeerID (org.p2pds.peer)
and which DIDs they replicate (org.p2pds.manifest). Other nodes discover
this info, fetch repos via CAR export, store blocks in IPFS, and verify
availability.

New modules: types, sync-storage, repo-fetcher, peer-discovery,
verification, and replication-manager orchestrator. Adds REPLICATE_DIDS
config, getMultiaddrs() to IpfsService, replication status/syncNow XRPC
endpoints, and 27 tests covering all components plus integration CAR
roundtrip.

22 tests covering IpfsService unit tests (lifecycle, block storage
roundtrips, BlockMap, graceful no-ops, provideBlocks), RASL endpoint
integration tests (IPFS/SQLite/blob fallback chain, 404, headers),
and config flag defaults.

Blocks and blobs are now stored in a Helia-managed FsBlockstore and
announced on the DHT. A new /.well-known/rasl/:cid endpoint serves
content-addressed blocks over HTTP with immutable caching. IPFS
operations are fire-and-forget and never block the commit path.
Existing blocks are backfilled on startup. Controlled via
IPFS_ENABLED and IPFS_NETWORKING env vars.

Port Cirrus (Cloudflare Workers PDS) to a standalone Node.js server:
- Hono HTTP framework via @hono/node-server
- better-sqlite3 replacing Cloudflare SqlStorage
- Filesystem blob storage replacing R2
- ws library replacing hibernatable WebSockets
- In-memory DID cache replacing Workers Cache API
- Bearer token + JWT session auth (OAuth/passkeys deferred)

Verified: health check, DID document, session management, record
CRUD, CAR export, and WebSocket firehose all functional.