Security: separate inter-node TCP port 4002 (CRIT-1, HIGH-1/2/10)
- Port 4001 is now client-only (hello/auth required)
- Port 4002 handles sv, fv, p_sync, ch_rep, w_* with per-session rate limits
- T1 fallback auth bypass removed (CRIT-1 FIXED)
- Separate connection pools prevent cross-pool exhaustion
- Witness peer connections use inter-node pool
- sv replication fallthrough bug fixed

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>