Pure stylistic refactor: pull the AllowedIPs match into a named
peerRoutesAddr helper and document why forward-target peers are excluded
from lazy connections. No behavior change; the existing address match is
preserved as-is.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>