Release v3.3: end-to-end encrypted audio, plus cue and reliability fixes

Headline: all audio is now encrypted (AES-256-GCM), keyed by a per-profile
password. Mandatory — v3.3 only interoperates with v3.3+.

Encryption
- RemSoundCrypto (Core): PBKDF2 key derivation, AES-GCM encrypt/decrypt
  (low-alloc, into-span), password fingerprint, light on-disk obfuscation.
- Wire: SenderLane encrypts the audio payload (PCM split across parts when the
  +28 overhead crosses MTU); AudioReceiver/StreamSession decrypt via a shared
  single-thread AudioDecryptor. Fingerprint piggybacks on the Format packet
  (offset 36, backward-compatible) so a peer can detect a password mismatch.
- Profile.Password (scrambled), carried through BuildCurrentProfile; MainForm
  derives + pushes the key/fingerprint to sender + receiver (RecomputeAudioCrypto).
- UX: ask-for-password on profile create; File -> Change this profile's password
  (ProfilePasswordDialog); Options -> Profile passwords (manager); a gate that
  prompts before streaming without a password; and a clear "passwords don't
  match" / "peer needs to update" message driven by the fingerprint.

Cue fixes
- CuePlayer (NAudio) replaces System.Media.SoundPlayer, which silently failed
  on the 96 kHz/24-bit cue WAVs (and any custom file) — cues now play reliably,
  resampled to 48 kHz/16-bit. Also fixes the Preferences preview button.
- Connect/disconnect cues now audio-gated with hysteresis: connected when audio
  flows OR heartbeat healthy; lost only when audio stops AND heartbeat
  unreachable. Kills false disconnects and the receive-only "no cues" case.
- Honest cue logging (played / muted / not loaded).

Smaller
- Endpoint stickiness: keep the audio target pinned to the heartbeat-proven
  address instead of chasing a multi-homed peer's other (unreachable) address.
- "Online/offline" label now audio+heartbeat aware, not discovery-only.
- "Show what's new after each update" preference (on by default).

Docs: About v3.3 block, RELEASE_NOTES, README (encryption as a headline),
manual section 12 "Passwords and encryption" (+ renumber), MANUAL.md regenerated.
Version 3.2.0 -> 3.3.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -1,6 +1,6 @@
 # RemSound
 
-**Free Windows app for sending live audio between two computers — across a house, across a city, or anywhere your internet reaches. Low delay, great quality, fully accessible to screen-reader users.**
+**Free Windows app for sending live audio between two computers — across a house, across a city, or anywhere your internet reaches. Encrypted end to end, low delay, great quality, fully accessible to screen-reader users.**
 
 [**Download the latest version**](https://github.com/Ednunp/RemSound/releases/latest)  ·  [**Read the user manual**](MANUAL.md)
 
@@ -12,6 +12,12 @@ You sit at one computer, RemSound captures whatever is playing — a track in yo
 
 It's also fully accessible. The interface was designed with screen readers (NVDA in particular) in mind from day one. Every button has a keyboard shortcut, every status line is read out clearly, and there are no menus or controls that need a mouse to reach.
 
+## Private by default — your audio is encrypted
+
+Everything RemSound sends is **encrypted end to end**: scrambled the moment it leaves your computer and only unscrambled at the other end, so nobody in between — your internet provider, a shared Wi-Fi, anyone watching the line — can listen in. You no longer need a VPN just to keep a private connection private.
+
+It works with a simple shared password. You and the person you're connecting to use the **same password**, and only the two of you can hear the audio — get the password wrong and nothing comes through. RemSound stores a password on each profile and walks you through setting one. And it all adds no delay you'd ever notice.
+
 ## What you can do with it
 
 * **Listen to one of your computers from another room.** Sit at your laptop and hear what's playing on your desktop. Walk around the house — the sound follows you.
@@ -30,7 +36,7 @@ Inside RemSound there's just one main decision: which quality and delay you want
 ## How to install it
 
 1. Go to the [latest release](https://github.com/Ednunp/RemSound/releases/latest).
-2. Download the file called `RemSound-v3.1.zip` (the version number changes over time — pick whichever is newest).
+2. Download the file called `RemSound-v3.3.zip` (the version number changes over time — pick whichever is newest).
 3. Extract the zip into a folder of your choice.
 4. Double-click `RemSound.exe` and away you go.