[fix] Re-probe reachability while the relay is firewalled

[ok]

The bug

On a live StartOS box the relay came up firewalled after an update and stayed that way, with the port forward, outbound gateway and public address all intact. The same box had been firewalled for 5.5 hours on 0.3.0 three days earlier, and both times a plain restart fixed it.

The cause is in dht-rpc. It probes reachability once at bootstrap (_checkIfFirewalled: up to 5 nodes are asked to ping the server port, and fewer than 3 replies counts as firewalled). Its periodic re-check is then guarded by:

if (this._lastHost === this._nat.host) {
  // do not recheck the same network...
  this._stableTicks = MORE_STABLE_TICKS
}

so while the public host is unchanged it never probes again. One lost round in the first seconds after a restart is permanent until the next one.

The fix

src/reprobe.js re-runs dht._updateNetworkState() — the same call dht-rpc's own tick makes, minus the same-host guard — while the node is firewalled: after 1 minute, doubling to a 15-minute ceiling, and stopping for good once a probe passes. It updates relay_dht_firewalled, which was previously only set at startup, and logs reachability re-probe passed.

It is not started under MIRALL_RELAY_ASSUME_REACHABLE. The hook is dht-rpc internals, so its absence degrades to a single warning and no self-heal; nothing else depends on it.

Testing

• test/unit/reprobe.test.js: never probes a reachable node; retries until a probe passes, then schedules nothing; backoff sequence and ceiling; a throwing probe does not end the retries; stop() cancels pending and in-flight work; a missing hook is a no-op with one warning.
• Run against the real pinned dht-rpc 6.27.0 on a NAT'd machine: the hook exists, each re-probe performs a real ~4 s ping round, and the node correctly stays firewalled where there is no forward.
• Not shown: a firewalled-to-reachable flip on a real forwarded host. That needs the StartOS box to land in the bad state again; the log line above is what to look for.
• npm run lint clean, npm test 408/408.