agent: unify listening and dialing with directed mutual measurements

Replace Probe with Agent across node runtime, Fleet contracts, backend state, API and storage. Report incoming sessions and outgoing link health through each Agent uplink, and retain directed link controls and retry.

Update protocol fixtures and end-to-end coverage for the unified model; accept requested cancellation during the Fleet timeout test cleanup.

backend/fleet/src/Fleet.Link/Peer.cs

@@ -22,7 +22,7 @@ public sealed class PeerListenerOptions
     /// <summary>按对端 ID 查找允许连接的公钥（SPKI）。不在列表里的对端一律拒绝（期望状态里的 peers）。</summary>
     public required Func<string, byte[]?> LookupPeerKey { get; init; }
 
-    /// <summary>预握手敲门：每个连接先过这一关（名册里的 Probe 才算得出敲门包），不通过就直接断开，什么都不写。</summary>
+    /// <summary>预握手敲门：每个连接先过这一关（名册里的 拨号方 才算得出敲门包），不通过就直接断开，什么都不写。</summary>
     public required KnockGate Knock { get; init; }
 
     public int MaxFrameBytes { get; init; } = 8 << 20;
@@ -131,7 +131,7 @@ public sealed class PeerListener
             }
 
             phase = "control_session";
-            _log.Info("peer session", ("probe", info.PeerId), ("result", "established"), ("remote", remote),
+            _log.Info("peer session", ("dialer", info.PeerId), ("result", "established"), ("remote", remote),
                 ("elapsed_ms", (long)_time.GetElapsedTime(started).TotalMilliseconds));
             await using (transport)
             {
@@ -228,7 +228,7 @@ public sealed class PeerListener
     }
 }
 
-/// <summary>发起点对点会话（Probe 一侧）：按 SPKI 指纹固定对端证书，用身份私钥签名，派生同样的数据面凭据。</summary>
+/// <summary>发起点对点会话（拨号方 一侧）：按 SPKI 指纹固定对端证书，用身份私钥签名，派生同样的数据面凭据。</summary>
 /// <summary>点对点会话的套接字：开启 TCP keepalive（空闲 30 秒后每 10 秒探测，连续 6 次无响应才断开，约 90 秒），主机真的没了的时候连接不会一直挂着；
 /// 但线路短暂中断（几十秒的黑洞）不能把会话杀掉——线路中断本来就是要测的东西，会话得扛过去，恢复之后接着测。</summary>
 internal static class PeerSockets
@@ -249,7 +249,7 @@ internal static class PeerSockets
     }
 }
 
-/// <summary>点对点会话的时间常数，Probe 和 Agent 两侧共用。</summary>
+/// <summary>点对点会话的时间常数，拨号方和监听方两侧共用。</summary>
 public static class PeerTimings
 {
     /// <summary>建立会话（连接、敲门、TLS、挑战应答）的总时限。</summary>
@@ -263,7 +263,8 @@ public static class PeerConnector
         ConnectAsync(host, port, agentPublicKey, identity, peerId, version, maxFrameBytes, time, NullNodeLog.Instance, ct);
 
     public static async Task<(PeerSessionInfo Info, TlsFrameTransport Transport)> ConnectAsync(
-        string host, int port, byte[] agentPublicKey, NodeIdentity identity, string peerId, string? version, int maxFrameBytes, TimeProvider time, INodeLog log, CancellationToken ct)
+        string host, int port, byte[] agentPublicKey, NodeIdentity identity, string peerId, string? version, int maxFrameBytes, TimeProvider time, INodeLog log, CancellationToken ct,
+        Action<string>? onPhase = null)
     {
         // 证书按公钥的指纹固定；敲门密钥由双方身份密钥派生
         byte[] expectedSpkiSha256 = NodeIdentity.Fingerprint(agentPublicKey);
@@ -271,6 +272,7 @@ public static class PeerConnector
         client.NoDelay = true;
         PeerSockets.EnableKeepAlive(client.Client);
         string phase = "tcp_connect";
+        onPhase?.Invoke(phase);
         long started = time.GetTimestamp();
         try
         {
@@ -280,15 +282,18 @@ public static class PeerConnector
             log.Info("peer TCP connected", ("remote", client.Client.RemoteEndPoint), ("local", client.Client.LocalEndPoint),
                 ("phase", phase), ("elapsed_ms", (long)time.GetElapsedTime(started).TotalMilliseconds));
             phase = "knock_send";
+            onPhase?.Invoke(phase);
             Stream stream = client.GetStream();
             await stream.WriteAsync(Knock.Build(Knock.DeriveKey(identity, agentPublicKey), time.GetUtcNow().ToUnixTimeMilliseconds()), linked.Token);
             phase = "tls";
+            onPhase?.Invoke(phase);
             var tls = new SslStream(
                 stream, leaveInnerStreamOpen: false,
                 (_, certificate, _, _) => certificate is not null && SpkiMatches(certificate, expectedSpkiSha256));
             await tls.AuthenticateAsClientAsync(new SslClientAuthenticationOptions { TargetHost = host }, linked.Token);
             log.Info("peer TLS established", ("phase", phase), ("tls", tls.SslProtocol), ("elapsed_ms", (long)time.GetElapsedTime(started).TotalMilliseconds));
             phase = "peer_auth";
+            onPhase?.Invoke(phase);
             var transport = new TlsFrameTransport(tls, maxFrameBytes);
 
             RpcFrame? first = await transport.ReceiveAsync(linked.Token);
@@ -326,9 +331,10 @@ public static class PeerConnector
         {
             if (!ct.IsCancellationRequested)
             {
+                bool timedOut = ex is OperationCanceledException;
                 log.Warn("peer control handshake failed", ("phase", phase), ("remote", host), ("port", port),
                     ("elapsed_ms", (long)time.GetElapsedTime(started).TotalMilliseconds), ("timeout_ms", PeerTimings.Handshake.TotalMilliseconds),
-                    ("exception", ex.GetType().Name), ("err", ex.Message),
+                    ("exception", timedOut ? "Timeout" : ex.GetType().Name), ("err", timedOut ? $"{phase} did not finish within {PeerTimings.Handshake.TotalSeconds:0}s" : ex.Message),
                     ("socket_error", ex is SocketException socket ? socket.SocketErrorCode : null));
             }
             client.Dispose();

backend/fleet/src/Fleet.Link/Transports.cs

@@ -112,7 +112,7 @@ public sealed class WsTransport : IRpcTransport
 }
 
 /// <summary>
-/// TLS 帧传输（Probe → Agent）：<c>u32 LE 正文长度 | u8 类型(0 文本, 1 二进制) | 正文</c>。
+/// TLS 帧传输（拨号方 → 监听方）：<c>u32 LE 正文长度 | u8 类型(0 文本, 1 二进制) | 正文</c>。
 /// 比 WebSocket 轻得多，Agent 不需要内置 HTTP 服务端。
 /// </summary>
 public sealed class TlsFrameTransport : IRpcTransport