feat(p2p): Phase 5 — single-socket architecture (Nebula-style)

Before Phase 5 WarzonePhone used THREE separate UDP sockets per
client:

  1. Signal endpoint         (register_signal, client-only)
  2. Reflect probe endpoints (one fresh socket per relay probe)
  3. Dual-path race endpoint (fresh per call setup)

This broke two things in production on port-preserving NATs
(MikroTik masquerade, most consumer routers):

  a. Phase 2 NAT detection was WRONG. Each probe used a fresh
     internal port, so MikroTik mapped each one to a different
     external port, and the classifier saw "different port per
     relay" and labeled it SymmetricPort. The real NAT was
     cone-like but measurement via fresh sockets hid that.

  b. Phase 3.5 dual-path P2P race was BROKEN. The reflex addr
     we advertised in DirectCallOffer was observed by the signal
     endpoint's socket. The actual dual-path race listened on a
     DIFFERENT fresh socket, on a different internal (and
     therefore external) port. Peers dialed the advertised addr
     and hit MikroTik's mapping for the signal socket, which
     forwarded to the signal endpoint — a client-only endpoint
     that doesn't accept incoming connections. Direct path
     silently failed, relay always won the race.

Nebula-style fix: one socket for everything. The signal endpoint
is now dual-purpose (client + server_config), and both the
reflect probes and the dual-path race reuse it instead of
creating fresh ones. MikroTik's port-preservation then gives us
a stable external port across all flows → classifier correctly
sees Cone NAT → advertised reflex addr is the actual listening
port → direct dials from peers land on the right socket →
`endpoint.accept()` in the A-role branch of the dual-path race
picks up the incoming connection.

## Changes

### `register_signal` (desktop/src-tauri/src/lib.rs)
- Endpoint now created with `Some(server_config())` instead of
  `None`. The socket can now accept incoming QUIC connections as
  well as dial outbound.
- Every code path that previously read `sig.endpoint` for the
  relay-dial reuse benefits automatically — same socket is now
  ALSO listening for peer dials.

### `probe_reflect_addr` (wzp-client/src/reflect.rs)
- New `existing_endpoint: Option<Endpoint>` arg. `Some` reuses
  the caller's socket (production: pass the signal endpoint).
  `None` creates a fresh one (tests + pre-registration).
- Removed the `drop(endpoint)` at the end — was correct for
  fresh endpoints (explicit early socket close) but incorrect
  for shared ones. End-of-scope drop does the right thing in
  both cases via Arc semantics.

### `detect_nat_type` (wzp-client/src/reflect.rs)
- New `shared_endpoint: Option<Endpoint>` arg, forwarded to
  every probe in the JoinSet fan-out. One shared socket means
  the classifier sees the true NAT type.

### `detect_nat_type` Tauri command (desktop/src-tauri/src/lib.rs)
- Reads `state.signal.endpoint` and passes it as the shared
  endpoint. Falls back to None when not registered. NAT detection
  now produces accurate classifications against MikroTik / most
  consumer NATs.

### `dual_path::race` (wzp-client/src/dual_path.rs)
- New `shared_endpoint: Option<Endpoint>` arg.
- A-role: when `Some`, reuses it for `accept()`. This is the
  critical change — the reflex addr advertised to peers is now
  the address listening for incoming direct dials.
- D-role: when `Some`, reuses it for the outbound direct dial.
  MikroTik keeps the same external port for the dial as for
  the signal flow → direct dial through a cone-mapped NAT.
- Relay path: also reuses the shared endpoint so MikroTik has
  a single consistent mapping across the whole call (saves one
  extra external port and makes firewall traces cleaner).
- When `None`, falls back to fresh per-role endpoints as before.

### `connect` Tauri command (desktop/src-tauri/src/lib.rs)
- Reads `state.signal.endpoint` once when acquiring own reflex
  addr and passes it through to `dual_path::race`.

### Tests
- `wzp-client/tests/dual_path.rs` and
  `wzp-relay/tests/multi_reflect.rs` updated to pass `None` for
  the new endpoint arg — tests use fresh sockets and that's
  fine because the loopback harness doesn't care about
  port-preserving NAT behavior.

Full workspace test: 423 passing (no regressions).

## Expected behavior after this commit on real hardware

Behind MikroTik + Starlink-bypass (the reporter's setup):
- Phase 2 NAT detect → **Cone NAT** (was SymmetricPort — false
  positive from the measurement artifact)
- Phase 3.5 direct-P2P dial → succeeds for both cone-cone and
  cone-CGNAT cases where the remote side was previously blocked
  by our own socket mismatch
- LTE ↔ LTE cross-carrier → still likely relay fallback; that's
  genuinely strict symmetric and needs Phase 5.5 port prediction.

## Phase 5.5 (next, separate PRD)

Multi-candidate port prediction + ICE-style candidate aggregation
for truly strict symmetric NATs. Not needed for the 95% case —
Phase 5 alone fixes most consumer-router setups.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

desktop/src-tauri/src/lib.rs

@@ -360,7 +360,10 @@ async fn connect(
     // own_reflex_addr, unparseable addrs, equal addrs), we skip
     // the race entirely and fall back to the pure-relay path —
     // identical to Phase 0 behavior.
-    let own_reflex_addr = state.signal.lock().await.own_reflex_addr.clone();
+    let (own_reflex_addr, signal_endpoint_for_race) = {
+        let sig = state.signal.lock().await;
+        (sig.own_reflex_addr.clone(), sig.endpoint.clone())
+    };
     let peer_addr_parsed: Option<std::net::SocketAddr> = peer_direct_addr
         .as_deref()
         .and_then(|s| s.parse().ok());
@@ -389,7 +392,20 @@ async fn connect(
                 }));
                 let room_sni = room.clone();
                 let call_sni = format!("call-{room}");
-                match wzp_client::dual_path::race(r, peer_addr, relay_sockaddr, room_sni, call_sni).await {
+                // Phase 5: pass the signal endpoint so the race
+                // reuses ONE socket for listen + dial + relay.
+                // The advertised reflex addr then matches the
+                // actual listening port and peers can reach us.
+                match wzp_client::dual_path::race(
+                    r,
+                    peer_addr,
+                    relay_sockaddr,
+                    room_sni,
+                    call_sni,
+                    signal_endpoint_for_race.clone(),
+                )
+                .await
+                {
                     Ok((transport, path)) => {
                         tracing::info!(?path, "connect: dual-path race resolved");
                         emit_call_debug(&app, "connect:dual_path_race_won", serde_json::json!({
@@ -760,8 +776,23 @@ fn do_register_signal(
     let identity_pub = *pub_id.signing.as_bytes();
     emit_call_debug(&app, "register_signal:identity_loaded", serde_json::json!({ "fingerprint": fp }));
 
+    // Phase 5: single-socket Nebula-style architecture. The signal
+    // endpoint is dual-purpose (client + server config). Every outbound
+    // flow — signal, reflect probes, relay media dials, direct-P2P
+    // dials — uses this same socket, so port-preserving NATs (MikroTik
+    // masquerade is the big one) give us a stable external port that
+    // peers can actually dial. The same socket also accepts incoming
+    // direct-P2P connections during the dual-path race.
+    //
+    // Was `None` before Phase 5 — that produced a client-only endpoint
+    // with a different internal port than later reflect / dual-path
+    // endpoints, which made MikroTik look symmetric and broke direct
+    // P2P because the advertised reflex port was not the listening
+    // port.
     let bind: std::net::SocketAddr = "0.0.0.0:0".parse().unwrap();
-    let endpoint = wzp_transport::create_endpoint(bind, None).map_err(|e| format!("{e}"))?;
+    let (server_cfg, _cert_der) = wzp_transport::server_config();
+    let endpoint = wzp_transport::create_endpoint(bind, Some(server_cfg))
+        .map_err(|e| format!("{e}"))?;
     emit_call_debug(&app, "register_signal:endpoint_created", serde_json::json!({ "bind": bind.to_string() }));
     let conn = wzp_transport::connect(&endpoint, addr, "_signal", wzp_transport::client_config())
         .await
@@ -1384,6 +1415,7 @@ async fn get_reflected_address(
 /// in; Rust side just does the network work.
 #[tauri::command]
 async fn detect_nat_type(
+    state: tauri::State<'_, Arc<AppState>>,
     relays: Vec<RelayArg>,
 ) -> Result<serde_json::Value, String> {
     // Parse relay args up front so a single malformed entry fails
@@ -1398,10 +1430,18 @@ async fn detect_nat_type(
         parsed.push((r.name, addr));
     }
 
+    // Phase 5: share the signal endpoint across all probes so
+    // they emit from the same source port. Port-preserving NATs
+    // (MikroTik, most consumer routers) give a stable external
+    // port → classifier correctly sees cone instead of falsely
+    // labeling SymmetricPort. Falls back to None (per-probe fresh
+    // endpoint) when not registered.
+    let shared_endpoint = state.signal.lock().await.endpoint.clone();
+
     // 1500ms per probe is generous: a same-host probe is < 10ms,
     // a cross-continent probe is typically < 300ms, and we want
     // to tolerate a one-off packet loss during connect.
-    let detection = wzp_client::reflect::detect_nat_type(parsed, 1500).await;
+    let detection = wzp_client::reflect::detect_nat_type(parsed, 1500, shared_endpoint).await;
     serde_json::to_value(&detection).map_err(|e| format!("serialize: {e}"))
 }