feat(nat): Tailscale-inspired STUN/ICE + port mapping + mid-call re-gathering (#28)

Phase 8: 5 new modules bringing NAT traversal close to Tailscale's approach.

- stun.rs: RFC 5389 STUN client — public server reflexive discovery,
  XOR-MAPPED-ADDRESS parsing, parallel probe with retry, STUN fallback
  in desktop try_reflect_own_addr()
- portmap.rs: NAT-PMP (RFC 6886) + PCP (RFC 6887) + UPnP IGD port
  mapping — gateway discovery, acquire/release/refresh lifecycle,
  new PeerCandidates.mapped candidate type in dial order
- ice_agent.rs: candidate lifecycle — gather(), re_gather(),
  apply_peer_update() with monotonic generation counter,
  CandidateUpdate signal message forwarded by relay
- netcheck.rs: comprehensive diagnostic — NAT type, IPv4/v6,
  port mapping availability, relay latencies, CLI --netcheck
- relay_map.rs: RTT-sorted relay map, preferred() selection,
  populate_from_ack() for RegisterPresenceAck.available_relays

Relay: CallRegistry stores + cross-wires caller/callee_mapped_addr
into CallSetup.peer_mapped_addr. Region config + available_relays
populated from federation peers in RegisterPresenceAck.

Desktop: place_call/answer_call call acquire_port_mapping() and
fill caller/callee_mapped_addr. STUN+relay combined NAT detection.

571 tests pass (66 new), 0 regressions, 0 warnings.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/wzp-client/tests/dual_path.rs

@@ -113,6 +113,7 @@ async fn dual_path_direct_wins_on_loopback() {
         PeerCandidates {
             reflexive: Some(acceptor_listen_addr),
             local: Vec::new(),
+            mapped: None,
         },
         relay_addr,
         "test-room".into(),
@@ -156,6 +157,7 @@ async fn dual_path_relay_wins_when_direct_is_dead() {
         PeerCandidates {
             reflexive: Some(dead_peer),
             local: Vec::new(),
+            mapped: None,
         },
         relay_addr,
         "test-room".into(),
@@ -195,6 +197,7 @@ async fn dual_path_errors_cleanly_when_both_paths_dead() {
         PeerCandidates {
             reflexive: Some(dead_peer),
             local: Vec::new(),
+            mapped: None,
         },
         dead_relay,
         "test-room".into(),