feat(mix): integrate LIONESS Sphinx payload encryption

[chaitanyaprem]

Summary

• Bumps vendor/nim-libp2p to vacp2p/nim-libp2p#2349 head — LIONESS wide-block cipher replaces AES-CTR for Sphinx payload encryption (header MAC unchanged).
• Picks up nim-libp2p master drift since cover-traffic's pinned commit (47 commits, including #2329 and the service-discovery rework) and adapts waku to the new APIs:
  • Redeclare MaxConnections* = 50 in waku_switch.nim (libp2p#2329 made the const private).
  • Migrate waku_kademlia.nim to the new service-discovery API: lookup() is now Result-returning, startAdvertising() no longer returns a bool, randomRecords() is private — use exported lookupRandom() instead.
• Adds simulations/mixnet/run_lioness_sim.sh — headless 5-mix-node sim driver for end-to-end verification.

Verification (run_lioness_sim.sh)

Metric	t0 (baseline)	t1 (post-traffic)
mix_cover_emitted_total (n1..n5)	0,1,2,1,1	8,8,9,7,7
mix_cover_received_total (n1..n5)	1,2,3,1,1	6,7,8,4,5
LIONESS / Sphinx errors in mix node logs	0	0

Cover traffic exercises the full Sphinx path (encrypt → multi-hop forward → unwrap at terminal hop where the leading-zeros tag identifies the cover packet). Counts increment as expected; zero DECRYPT_FAILED or leading-zeros-check failures across all nodes.

Chat-side delivery (alice → bob) still fails on the existing RLN spam-protection epoch-quota issue (Message id (4) is not within user_message_limit (4)) — pre-existing on the cover-traffic baseline, unrelated to LIONESS.

Test plan

• make chat2mix wakunode2 builds clean against the bumped submodule
• 5-node sim verifies LIONESS-encrypted Sphinx end-to-end via cover-traffic metrics
• Re-run after upstream PR 2349 merges and the regular nim-libp2p master-bump rolls onto feat/cover-traffic

🤖 Generated with Claude Code

[github-actions]

You can find the image built from this PR at

quay.io/wakuorg/nwaku-pr:3837

Built from f14fcb6