Release v3.3: end-to-end encrypted audio, plus cue and reliability fixes

Headline: all audio is now encrypted (AES-256-GCM), keyed by a per-profile
password. Mandatory — v3.3 only interoperates with v3.3+.

Encryption
- RemSoundCrypto (Core): PBKDF2 key derivation, AES-GCM encrypt/decrypt
  (low-alloc, into-span), password fingerprint, light on-disk obfuscation.
- Wire: SenderLane encrypts the audio payload (PCM split across parts when the
  +28 overhead crosses MTU); AudioReceiver/StreamSession decrypt via a shared
  single-thread AudioDecryptor. Fingerprint piggybacks on the Format packet
  (offset 36, backward-compatible) so a peer can detect a password mismatch.
- Profile.Password (scrambled), carried through BuildCurrentProfile; MainForm
  derives + pushes the key/fingerprint to sender + receiver (RecomputeAudioCrypto).
- UX: ask-for-password on profile create; File -> Change this profile's password
  (ProfilePasswordDialog); Options -> Profile passwords (manager); a gate that
  prompts before streaming without a password; and a clear "passwords don't
  match" / "peer needs to update" message driven by the fingerprint.

Cue fixes
- CuePlayer (NAudio) replaces System.Media.SoundPlayer, which silently failed
  on the 96 kHz/24-bit cue WAVs (and any custom file) — cues now play reliably,
  resampled to 48 kHz/16-bit. Also fixes the Preferences preview button.
- Connect/disconnect cues now audio-gated with hysteresis: connected when audio
  flows OR heartbeat healthy; lost only when audio stops AND heartbeat
  unreachable. Kills false disconnects and the receive-only "no cues" case.
- Honest cue logging (played / muted / not loaded).

Smaller
- Endpoint stickiness: keep the audio target pinned to the heartbeat-proven
  address instead of chasing a multi-homed peer's other (unreachable) address.
- "Online/offline" label now audio+heartbeat aware, not discovery-only.
- "Show what's new after each update" preference (on by default).

Docs: About v3.3 block, RELEASE_NOTES, README (encryption as a headline),
manual section 12 "Passwords and encryption" (+ renumber), MANUAL.md regenerated.
Version 3.2.0 -> 3.3.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/RemSound.App/AboutDialog.cs

@@ -20,6 +20,47 @@ internal sealed class AboutDialog : Form
     /// updates" path.</summary>
     private const string ReleaseNotes =
         """
+        RemSound v3.3
+
+        Your audio is now encrypted, end to end, so you no
+        longer need a VPN just to keep it private.
+
+        How it works: every profile has a password. You and
+        the person you're connecting to must use the SAME
+        password — then your audio is scrambled on the way
+        out and only unscrambled at the other end. Anyone in
+        between hears nothing usable. The password is what
+        lets you connect: matching passwords connect, and
+        you hear each other; different passwords mean no
+        audio (RemSound tells you when that happens).
+
+        Setting a password: when you create a profile it asks
+        for one. You can change it any time with File → Change
+        this profile's password, and you can see and edit the
+        passwords for ALL your profiles in one place under
+        Options → Profile passwords. If you try to start
+        sending or receiving on a profile that has no password
+        yet, RemSound asks you to set one first.
+
+        Adds almost no delay — the scrambling takes millionths
+        of a second per packet, far less than the audio itself.
+
+        Important: because the audio format changed, v3.3 can
+        only talk to other v3.3 (and later) copies. Anyone you
+        connect with needs to update to v3.3 too.
+
+        Also in this release: connect, disconnect and the
+        other cue sounds now play reliably whatever format the
+        WAV is in (they used to be hit-and-miss with high-
+        resolution files); the connect/disconnect cues now
+        follow the actual audio, so you won't hear a false
+        "disconnect" while sound is still playing; the system
+        tray icon sticks to a peer's working address instead
+        of hopping between a VPN and a LAN address (which could
+        cause crackle on some setups); and RemSound now offers
+        to show you what's new after each update (on by
+        default; turn it off in Preferences).
+
         RemSound v3.2
 
         A new audio cue, plus the reliability work from