feat(mix): DoS protection integration

[chaitanyaprem]

Adds DoS / spam protection to the mix protocol (RLN-based).

The logos_delivery/ folder restructure (#3935) and the service-discovery framework (#3947) are now in master. This branch is rebased onto current master, so they're no longer part of this diff — this PR's delta is the mix DoS-protection work, the libp2p v2.1.4 bump, and minor fixes.

What's in this PR

Mix DoS / spam protection (RLN)

• Integrates mix-rln-spam-protection-plugin into the mix protocol — mix messages carry an RLN proof, intermediate hops verify it, per-sender rate-limited via userMessageLimit. (waku_mix/protocol.nim, waku_node.nim)
• Stateless RLN (Nim-side IMT, ffi_verify_with_roots; no local Merkle tree).
• DoS self-registration split into a background retry task off the startup path.
• Spam-protection coordination over Waku filter (waku_mix_coordination.nim, new).

libp2p v2.1.4 bump

• libp2p moves from the nim-libp2p.git#v2.0.0 git-URL pin to the version form libp2p == 2.1.4. nim-libp2p-mix master and the RLN plugin both require libp2p == 2.1.4 by package name, and nimble treats a git-URL pin and a name+version requirement as distinct packages — the diamond only collapses when every side uses the same form.
• libp2p_mix → master (c387ca6), which carries the v2.1.4 bump (chore: bump libp2p to v2.1.4 logos-co/nim-libp2p-mix#23) and LIONESS wide-block payload encryption (feat(sphinx): LIONESS wide-block payload encryption (LIP-183) logos-co/nim-libp2p-mix#30, LIP-183).
• mix-rln-spam-protection-plugin → main (135182b, chore: pin libp2p to v2.1.4 release tag logos-co/mix-rln-spam-protection-plugin#12, merged).
• libp2p 2.1.4 raises dependency floors: lsquic v0.5.1 → v0.5.6 (libp2p requires >= 0.5.4); metrics 0.2.2 and protobuf_serialization 0.5.3 resolved into nimble.lock.
• Upstream removed libp2p/utility (vacp2p/nim-libp2p 77fc086ac, "unify and dedup utilities") and split it into libp2p/utils/*. 15 call sites now import utils/shortlog or utils/opt, or drop the import where it had become unused — import-only changes.
• PublishCallback now returns Future[Result[void, string]], so waku_mix propagates coordination-publish failures instead of swallowing them.
• Dropped the global switch("import", ".../compat/option_valueor") from config.nims: master's Option→Opt migration (chore: replace Option with Opt #4035) removed that compat module, so the implicit import was dangling.

Adaptive mix-peer discovery — generic runServicePeerTopUp loop pulls more mix-service peers via the ServicePeersRequest broker while the pool is below target; keeps WakuKademlia generic.

Minor — chat2mix demo + mixnet sim harness (simulations/mixnet/); dep pins (mix-rln-spam-protection-plugin, libp2p_mix, nim-sds); small build/test fixes.

Validation

• wakunode2 + chat2mix build clean against libp2p 2.1.4 on the rebased base.
• Mixnet sim (5 mix nodes + 2 chat clients): a lightpush message is routed through two intermediate hops and unwrapped at the exit node, which recovers the plaintext byte-for-byte from the Sphinx payload. Since mix master replaces AES-CTR payload encryption with LIONESS, correct recovery exercises LIONESS encrypt → per-hop unwrap → exit decrypt on libp2p 2.1.4. Spam protection proof verified successfully at every relaying hop; message delivered back to the subscribed client via filter push.
• Note: the unit-test suite (incl. tests/waku_kademlia, previously 14/14) has not been re-run since the 2.1.4 bump and rebase — worth a CI pass before merge.

[github-actions]

You can find the image built from this PR at

quay.io/wakuorg/nwaku-pr:3931

Built from fbb612b

[Ivansete-status]

Thanks for that PR @chaitanyaprem
Nevertheless, we want to have the nim-libp2p bump to v2.0.0 into a separate PR and @fcecin is currently working on that. We'll keep you posted.

[fcecin]

Thanks for that PR @chaitanyaprem Nevertheless, we want to have the nim-libp2p bump to v2.0.0 into a separate PR and @fcecin is currently working on that. We'll keep you posted.

Also it may be possible that some of the work in this PR should be ported to the other bump PR in any case (i.e. if what is done here to bump is preferred over what I did in my PR to bump)

[chaitanyaprem]

Thanks for that PR @chaitanyaprem Nevertheless, we want to have the nim-libp2p bump to v2.0.0 into a separate PR and @fcecin is currently working on that. We'll keep you posted.

Makes sense, i was doing this more from a point of validating using single zerokit compiled lib for both rln relay and mix DoS protection. I got stuck and had to do this update, so i thought it would be useful for whoever is doing the bump hence checked it in.

The idea is once you guys bump libp2p, i will just rebase onto that and only have mix related changes :)

[chaitanyaprem]

Also it may be possible that some of the work in this PR should be ported to the other bump PR in any case (i.e. if what is done here to bump is preferred over what I did in my PR to bump)

I would leave that upto you, i just took shortest and easiest path to make it work in order to test mix DoS protection simulation with zerokit-2.0.2 statless built and reused across rln relay and mix. You may have better idea if some of these changes make sense or not.

Let me know once 2.0.0 bump branch is ready so that i can rebase onto it.

[github-actions]

This PR may contain changes to configuration options of one of the apps.

If you are introducing a breaking change (i.e. the set of options in latest release would no longer be applicable) make sure the original option is preserved with a deprecation note for 2 following releases before it is actually removed.

Please also make sure the label release-notes is added to make sure any changes to the user interface are properly announced in changelog and release notes.

[github-actions]

This PR may contain changes to database schema of one of the drivers.

If you are introducing any changes to the schema, make sure the upgrade from the latest release to this change passes without any errors/issues.

Please make sure the label release-notes is added to make sure upgrade instructions properly highlight this change.

[Ivansete-status]

Some comments so far. Thanks!