feat: Phase 3 — crypto handshake, codec2, benchmarks, audio I/O, relay forwarding

E2E crypto handshake:
- Client/relay handshake via SignalMessage (CallOffer/CallAnswer)
- X25519 ephemeral key exchange with Ed25519 identity signatures
- Integration tests proving bidirectional encrypt/decrypt

Codec2 integration:
- Pure Rust codec2 crate (v0.3) — no C bindings needed
- MODE_3200 (160 samples/20ms, 8 bytes) and MODE_1200 (320 samples/40ms, 6 bytes)
- 11 new tests including encode/decode roundtrip and adaptive switching

Relay forwarding:
- Bidirectional client → remote forwarding with pipeline processing
- CLI args: --listen, --remote
- Periodic stats logging, clean shutdown via tokio::select!

Benchmark tool (wzp-bench):
- Codec roundtrip, FEC recovery, crypto throughput, full pipeline benchmarks
- Sine wave PCM generator for realistic testing

Audio I/O (cpal):
- AudioCapture (microphone) and AudioPlayback (speakers) at 48kHz mono
- CLI --live mode: mic → encode → send / recv → decode → speakers

120 tests passing, 0 failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/wzp-client/src/call.rs

@@ -160,8 +160,8 @@ pub struct CallDecoder {
     fec_dec: RaptorQFecDecoder,
     /// Jitter buffer.
     jitter: JitterBuffer,
-    /// Quality controller.
-    quality: AdaptiveQualityController,
+    /// Quality controller (used when ingesting quality reports).
+    pub quality: AdaptiveQualityController,
     /// Current profile.
     profile: QualityProfile,
 }
@@ -208,8 +208,14 @@ impl CallDecoder {
                 }
             }
             PlayoutResult::Missing { seq } => {
-                debug!(seq, "packet loss, generating PLC");
-                self.audio_dec.decode_lost(pcm).ok()
+                // Only generate PLC if there are still packets buffered ahead.
+                // Otherwise we've drained everything — return None to stop.
+                if self.jitter.depth() > 0 {
+                    debug!(seq, "packet loss, generating PLC");
+                    self.audio_dec.decode_lost(pcm).ok()
+                } else {
+                    None
+                }
             }
             PlayoutResult::NotReady => None,
         }