Upgrade to iroh 1.2 and report relay auth denials

[andrewchen5678]

Summary

• Require iroh >=1.2.0, <1.3.0. Lockfile: iroh / iroh-base / iroh-relay 1.2.0, iroh-dns 1.3.0, noq 1.3.0. No API breaks. The e2e CI job now installs iroh-relay 1.2.0.
• Adopt the new RelayStatus::auth_denied_reason (feat(iroh): add RelayStatus::auth_denied_reason and example n0-computer/iroh#4501):
  • A relay probe (startup and restore) that times out now reads the relay's status before closing and reports the actual cause, e.g. authentication denied by the relay (<reason>); check the relay auth token or disconnected (<error>), instead of "unreachable or rejected the auth token".
  • The failover outage report uses the same description via a shared relay_failure() helper. Failover behaviour is unchanged.
• Version references updated in Cargo.toml, README.md, src/lib.rs.

Relay failover in iroh 1.2.0

net_report (home-relay selection) did not change between 1.1.0 and 1.2.0, so a home relay that answers probes but refuses connections still wedges the endpoint; relay_failover is still needed. Upstream work to watch:

• fix(iroh): keep the remote actor responsive during Initial sends n0-computer/iroh#4512 (merged, unreleased): keeps a peer's remote actor responsive while a relay send queue is full.
• [wip] fix(iroh): survive home relay changes on relay-only connections n0-computer/iroh#4435 (open, WIP): re-home and move relay-only connections onto the new home relay when the home relay connection dies; could absorb part of our failover (see e2e phase D).

Test plan

• cargo clippy --all-targets --all-features: clean
• cargo test --all-features: 26 passed
• e2e/run_e2e.sh --local-relays and --local-relays --relay-only against iroh-relay 1.2.0: all pass
• e2e/run_relay_failover.sh against iroh-relay 1.2.0: phases A–D all pass
• The new auth-denied message has not been observed in a live run (the e2e harness does not print server logs)

🤖 Generated with Claude Code

https://claude.ai/code/session_01C44v6KPU4Jc5arm6ML48Go