feat: relay ping with RTT, server TOFU, lock icons (Phase 2 backport)

Rust JNI:
- nativePingRelay: QUIC connect with 3s timeout, returns RTT + server
  certificate fingerprint as JSON. Static method, no engine needed.

Kotlin:
- WzpEngine.pingRelay() static wrapper
- SettingsRepository: TOFU fingerprint persistence (tofu_{address} keys)
- CallViewModel: pingAllServers() coroutine, lockStatus() helper,
  PingResult/LockStatus data types
- InCallScreen: server chips show lock icon + RTT color (green/yellow),
  "Ping All" button

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

android/app/src/main/java/com/wzp/engine/WzpEngine.kt

@@ -158,6 +158,15 @@ class WzpEngine(private val callback: WzpCallback) {
         init {
             System.loadLibrary("wzp_android")
         }
+
+        /**
+         * Ping a relay server. Returns JSON `{"rtt_ms":N,"server_fingerprint":"hex"}`
+         * or null if unreachable. Does not require an engine instance.
+         */
+        fun pingRelay(address: String): String? = nativePingRelay(address)
+
+        @JvmStatic
+        private external fun nativePingRelay(relay: String): String?
     }
 }