feat(nat): Tailscale-inspired STUN/ICE + port mapping + mid-call re-gathering (#28)

Phase 8: 5 new modules bringing NAT traversal close to Tailscale's approach.

- stun.rs: RFC 5389 STUN client — public server reflexive discovery,
  XOR-MAPPED-ADDRESS parsing, parallel probe with retry, STUN fallback
  in desktop try_reflect_own_addr()
- portmap.rs: NAT-PMP (RFC 6886) + PCP (RFC 6887) + UPnP IGD port
  mapping — gateway discovery, acquire/release/refresh lifecycle,
  new PeerCandidates.mapped candidate type in dial order
- ice_agent.rs: candidate lifecycle — gather(), re_gather(),
  apply_peer_update() with monotonic generation counter,
  CandidateUpdate signal message forwarded by relay
- netcheck.rs: comprehensive diagnostic — NAT type, IPv4/v6,
  port mapping availability, relay latencies, CLI --netcheck
- relay_map.rs: RTT-sorted relay map, preferred() selection,
  populate_from_ack() for RegisterPresenceAck.available_relays

Relay: CallRegistry stores + cross-wires caller/callee_mapped_addr
into CallSetup.peer_mapped_addr. Region config + available_relays
populated from federation peers in RegisterPresenceAck.

Desktop: place_call/answer_call call acquire_port_mapping() and
fill caller/callee_mapped_addr. STUN+relay combined NAT detection.

571 tests pass (66 new), 0 regressions, 0 warnings.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/wzp-relay/tests/hole_punching.rs

@@ -82,6 +82,7 @@ fn handle_answer_and_build_setups(
         relay_addr: "203.0.113.5:4433".into(),
         peer_direct_addr: callee_addr,
         peer_local_addrs: Vec::new(),
+        peer_mapped_addr: None,
     };
     let setup_for_callee = SignalMessage::CallSetup {
         call_id,
@@ -89,6 +90,7 @@ fn handle_answer_and_build_setups(
         relay_addr: "203.0.113.5:4433".into(),
         peer_direct_addr: caller_addr,
         peer_local_addrs: Vec::new(),
+        peer_mapped_addr: None,
     };
     (setup_for_caller, setup_for_callee)
 }
@@ -105,6 +107,7 @@ fn mk_offer(call_id: &str, caller_reflexive_addr: Option<&str>) -> SignalMessage
         supported_profiles: vec![],
         caller_reflexive_addr: caller_reflexive_addr.map(String::from),
         caller_local_addrs: Vec::new(),
+        caller_mapped_addr: None,
         caller_build_version: None,
     }
 }
@@ -123,6 +126,7 @@ fn mk_answer(
         chosen_profile: None,
         callee_reflexive_addr: callee_reflexive_addr.map(String::from),
         callee_local_addrs: Vec::new(),
+        callee_mapped_addr: None,
         callee_build_version: None,
     }
 }