Release v3.3: end-to-end encrypted audio, plus cue and reliability fixes

Headline: all audio is now encrypted (AES-256-GCM), keyed by a per-profile
password. Mandatory — v3.3 only interoperates with v3.3+.

Encryption
- RemSoundCrypto (Core): PBKDF2 key derivation, AES-GCM encrypt/decrypt
  (low-alloc, into-span), password fingerprint, light on-disk obfuscation.
- Wire: SenderLane encrypts the audio payload (PCM split across parts when the
  +28 overhead crosses MTU); AudioReceiver/StreamSession decrypt via a shared
  single-thread AudioDecryptor. Fingerprint piggybacks on the Format packet
  (offset 36, backward-compatible) so a peer can detect a password mismatch.
- Profile.Password (scrambled), carried through BuildCurrentProfile; MainForm
  derives + pushes the key/fingerprint to sender + receiver (RecomputeAudioCrypto).
- UX: ask-for-password on profile create; File -> Change this profile's password
  (ProfilePasswordDialog); Options -> Profile passwords (manager); a gate that
  prompts before streaming without a password; and a clear "passwords don't
  match" / "peer needs to update" message driven by the fingerprint.

Cue fixes
- CuePlayer (NAudio) replaces System.Media.SoundPlayer, which silently failed
  on the 96 kHz/24-bit cue WAVs (and any custom file) — cues now play reliably,
  resampled to 48 kHz/16-bit. Also fixes the Preferences preview button.
- Connect/disconnect cues now audio-gated with hysteresis: connected when audio
  flows OR heartbeat healthy; lost only when audio stops AND heartbeat
  unreachable. Kills false disconnects and the receive-only "no cues" case.
- Honest cue logging (played / muted / not loaded).

Smaller
- Endpoint stickiness: keep the audio target pinned to the heartbeat-proven
  address instead of chasing a multi-homed peer's other (unreachable) address.
- "Online/offline" label now audio+heartbeat aware, not discovery-only.
- "Show what's new after each update" preference (on by default).

Docs: About v3.3 block, RELEASE_NOTES, README (encryption as a headline),
manual section 12 "Passwords and encryption" (+ renumber), MANUAL.md regenerated.
Version 3.2.0 -> 3.3.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/RemSound.Core/AppConfig.cs

@@ -104,6 +104,20 @@ public sealed class AppConfig
     /// startup check; the periodic timer (if set) still runs.</summary>
     public bool CheckForUpdatesOnStartup { get; set; } = true;
 
+    /// <summary>If true, RemSound opens the About box (which leads with the latest release
+    /// notes) once on the first launch AFTER an update has been installed, so the user sees
+    /// "what's new" without going looking. Default false — opt-in. Detected by comparing the
+    /// running version against <see cref="LastWhatsNewVersion"/> at launch, so it only fires
+    /// when the version actually changed, never on an ordinary relaunch. On by default — it's a
+    /// discoverability aid (see what changed), not a data-persistence toggle, so the usual
+    /// "auto-options default off" rule doesn't really apply; users can untick it.</summary>
+    public bool ShowWhatsNewAfterUpdate { get; set; } = true;
+
+    /// <summary>The app version recorded at the last launch. Used only to detect "the version
+    /// changed since last run" for <see cref="ShowWhatsNewAfterUpdate"/>. Null until first
+    /// recorded, so a fresh install never counts as an update.</summary>
+    public string? LastWhatsNewVersion { get; set; }
+
     /// <summary>If true, RemSound tries to open the audio port (UDP 47830) on the local router
     /// using UPnP / NAT-PMP / PCP, so peers on the public internet can reach this machine
     /// without manual port forwarding. Default false — the toggle opt-in only, because some