Pushes name the peer by ticket, and an allowance can confirm its push

PeerAllowPush and Push take a blob ticket the peer issued as well as a
NodeId; the ticket's addresses are remembered, so the push dials
directly. A peer allowed to push may observe too: the sender confirms a
push by observing it, and without that every allowance-only push
reported failure though it had landed. The allowance test now fails
instead of skipping on anything but an unreachable peer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

varde-proto/src/lib.rs

@@ -127,7 +127,8 @@ pub enum Request {
     /// phones at the same place) and let it lapse. Asking again extends
     /// it; [`Request::PeerUntrust`] ends it early. Added in varde 0.1.5.
     PeerAllowPush {
-        /// The peer's iroh NodeId (z-base-32).
+        /// The peer's iroh NodeId (z-base-32), or a blob ticket it issued
+        /// (varde 0.1.6+), whose addresses are then used to reach it.
         node_id: String,
         /// How long the allowance lasts, in seconds.
         ttl_secs: u64,
@@ -142,6 +143,9 @@ pub enum Request {
     /// policy), so the content survives gc and shows up in `List`.
     Push {
         /// Hash (hex) of the fully-present blob or HashSeq root to push.
+        ///
+        /// The receiver below may be a NodeId or, from varde 0.1.6, a blob
+        /// ticket it issued.
         hash: String,
         /// The receiving peer's iroh NodeId (z-base-32).
         node_id: String,