Add configurable media-aware managed session reaping

docs/porting-to-dotnet.md

@@ -745,8 +745,12 @@ BouncyCastle crypto fallback are excluded from its zero-allocation guarantee.
 Two real C++ `vccli` processes also pass join/text/bidirectional voice tests using
 finite `--test-tone-ms` external capture/playback. The transport load test delivers
 all 2,500 recipient packets from a sender paced at 50 pps to 50 subscribers.
-Administration, protected joins, production configuration and media-aware reaping
-still remain before Phase 4 completion.
+**Reaper checkpoint:** configurable 45-second idle expiry / 15-second sweep replaces
+the TCP-only idle timeout. Control envelopes, authenticated voice and bound-endpoint
+keepalives refresh shared monotonic activity; invalid media does not. Reaping removes
+presence and media routing, and can be disabled. Tests inject a clock to cover silent
+clients, UDP-only activity, forged media, single departure events and disabled expiry.
+Administration, protected joins and production configuration remain before Phase 4 completion.
 
 1. `VoiceCat.Server`: accept loop, `ConnSession` protocol handling, session registry.
 2. `Db` on `Microsoft.Data.Sqlite` — same schema. **Resolve the Argon2id hash-compat