feat(ui): birthday attack toggle in settings (default off)

New setting: "Birthday attack (opens extra ports for hard NAT)"
- Default: OFF — no extra latency on call setup
- When ON: waits up to 3s for peer's birthday ports if peer has
  non-cone NAT, adds them to the dial race

Gated end-to-end: Settings → localStorage → JS invoke →
Rust connect param → birthday wait + target injection.
LAN/cone calls unaffected regardless of setting.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

desktop/index.html

@@ -191,6 +191,10 @@
               <input id="s-direct-only" type="checkbox" />
               Direct-only mode (no relay fallback — fails if P2P can't connect)
             </label>
+            <label class="checkbox">
+              <input id="s-birthday-attack" type="checkbox" />
+              Birthday attack (opens extra ports for hard NAT — adds ~3s to setup)
+            </label>
           </div>
           <div class="settings-section" id="s-call-debug-section" style="display:none">
             <h3>Call Debug Log</h3>