v5.2: stability and polish — deep-audit bug fixes + install-flow fixes

Verified findings from a multi-dimension code audit, plus the two install-flow bugs:
- Fix Opus encoder use-after-free on a codec/rate change while streaming (guard swap vs encode).
- Fix "both" single-file recording dropping audio + drifting (drain both directions in lockstep).
- Fix broken clip counter, UPnP teardown on exit, auto-update-restart foreground grant, and a
  malformed-Opus-format packet orphaning a playout session forever.
- Post-install relaunch now respects start-minimised; uninstall is path-aware so it won't clear a
  different copy's run-at-startup.
- Perf/hygiene: cache AppConfig off UI hot paths, fold per-peer EQ+gain into one pass, deterministic
  disposal (tray menu, timers, COM shortcut, Process handles, process meter), ring-buffer overflow
  guard, receiver session-lock fix, remote-control allow-list moved onto the UI thread.
- Remove dead code (two IsAsioBackend, SessionPlayout.Reset, IsSameEndpoint, RemSoundUpdater
  IDisposable); several stale-doc fixes.

Deferred (not in this release): drift-estimator tweak, peer-discovery pruning, uninstall retry-loop,
encryption nonce. Wire format unchanged (interops v3.3-v5.1). Version -> 5.2.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/RemSound.App/UpdateApplier.cs

@@ -204,12 +204,24 @@ internal static class UpdateApplier
         {
             var exe = Path.Combine(target, "RemSound.exe");
             if (!File.Exists(exe)) { log($"cannot restart — {exe} missing"); return; }
-            Process.Start(new ProcessStartInfo { FileName = exe, WorkingDirectory = target, UseShellExecute = true });
+            // Give the restarted copy the same foreground treatment as the post-install relaunch, so it
+            // doesn't reopen BEHIND other windows where a blind user wouldn't notice it came back (the
+            // old copy has already exited, so a fresh process has no foreground credit of its own).
+            // --foreground makes it pull itself forward; the AllowSetForegroundWindow grant is
+            // best-effort (this staged updater may not hold foreground rights to give away).
+            var psi = new ProcessStartInfo { FileName = exe, WorkingDirectory = target, UseShellExecute = true };
+            psi.ArgumentList.Add("--foreground");
+            using var child = Process.Start(psi);
+            if (child is not null) { try { AllowSetForegroundWindow(child.Id); } catch { } }
             log("RemSound restarted");
         }
         catch (Exception ex) { log($"could not restart RemSound: {ex.Message}"); }
     }
 
+    [System.Runtime.InteropServices.DllImport("user32.dll")]
+    [return: System.Runtime.InteropServices.MarshalAs(System.Runtime.InteropServices.UnmanagedType.Bool)]
+    private static extern bool AllowSetForegroundWindow(int dwProcessId);
+
     /// <summary>Best-effort temp cleanup. We're running FROM the stage, so we can't delete our own
     /// exe's folder here — the restarted app finishes that on startup (see Program.CleanUpUpdateStages).</summary>
     private static void CleanupStage(string? stageRoot, Action<string> log)