Add configurable media-aware managed session reaping

docs/api-dotnet.md

@@ -181,7 +181,14 @@ owns each `TlsSession`; handlers exchange envelopes through bounded queues.
 This checkpoint caps connections at 64, queued input at 32 envelopes, queued output
 at 64 envelopes, and each control payload at 64 KiB (stricter than the shared framer's
 16 MiB limit). Queue exhaustion disconnects slow consumers. Handshake timeout is
-15 seconds; completed TLS connections have a 60-second receive-idle timeout.
+15 seconds by default. Completed TLS connections use the server's media-aware reaper.
+
+The existing `VoiceServer(directory, endpoint, allowGuests, name)` constructor remains
+available. An overload accepts `VoiceServerOptions` and an optional `TimeProvider`.
+Options configure server name, guest access, connection limit (default 64), handshake
+timeout (15 seconds), idle timeout (45 seconds) and reaper interval (15 seconds).
+Zero idle timeout disables reaping; active reaping requires a positive interval.
+Invalid options fail before creating credentials, databases or sockets.
 
 Authentication starts users in unprotected Lobby (id 1), subject to its capacity.
 Success returns permissions, then a cloned snapshot; peers receive joined/updated/left
@@ -218,8 +225,12 @@ Control handlers publish immutable routing snapshots. Crypto is created within t
 TLS owner loop and transferred once. A coalesced notification wakes retired-key cleanup.
 The synchronous fan-out core allocates zero managed bytes with platform ChaCha20-Poly1305;
 socket scheduling and the allocating BouncyCastle fallback are outside that guarantee.
-UDP keepalives are echoed for bound endpoints. The full media-aware reaper remains pending;
-the existing 60-second TLS receive-idle timeout still applies.
+UDP keepalives are echoed for bound endpoints. Any parsed control envelope, authenticated
+voice from an active owned stream, or exact header-only keepalive from a bound endpoint
+refreshes a shared monotonic activity timestamp. Invalid media does not refresh it.
+The reaper sends a fatal disconnect, removes presence/routing and broadcasts one LEFT
+event. Valid UDP activity keeps a TCP-idle client alive. Shutdown cancels and awaits
+the accept, reaper, control and media loops before disposing credentials/storage.
 
 `AccountStore(path)` retains the C++ schema version 2, accepts version 1 migration,
 and rejects unknown revisions. Opening an existing channel table does not reseed it.