fix(net): broadcast LEFT on disconnect, add keepalive/reaper, cap PLC hiss

Three reported bugs traced to one root cause plus two missing designed features:

1. Stale users + eternal PLC hiss (root cause): ConnSession::close() silently
   erased dropped users without broadcasting UserEvent::LEFT, so peers never
   learned the user left and their audio engines never called remove_stream —
   Opus PLC synthesized comfort noise forever. Fix: broadcast_left() helper
   + close() broadcasts LEFT before erasing.

2. PLC cap (defense-in-depth): on_playback now caps pure PLC at ~2s, then
   emits digital silence so a stale stream can never hiss forever even if
   remove_stream is skipped. Resets automatically on fresh packets.

3. No timeout / no ping: client never sent Ping, server had no last_seen /
   reaper, so half-open connections (NAT timeout, wifi loss, sleep) left
   ghost users forever. Fix: client Ping every 15s with RTT measurement,
   ConnSession::last_seen bumped on every inbound TCP/UDP frame, steady_timer
   reaper sweeps every 15s and drops sessions older than 45s (configurable
   via server::Config).

4. UDP KEEPALIVE: client sends plaintext kFrameKeepalive every 5s; server
   bumps last_seen + echoes back. Keeps NAT bindings alive and lets media
   activity defer the reaper independently of TCP.

5. Graceful client disconnect: vc_disconnect() sends Disconnect{code=0} via
   a flag-based io-thread exit (no double-close race); server handles
   client-sent Disconnect with immediate close() + LEFT broadcast.

3 new tests: disconnect_left, plc_cap, reaper_timeout. 21/21 ctest green.

Docs: protocol.md §6/§7, voice.md §6, architecture.md §5, PROGRESS.md.

PROGRESS.md

@@ -10,6 +10,44 @@ up instantly. Newest status at the top.
 
 ## ▶ Where we left off / next action
 
+- **Done:** **Disconnect, timeout & keepalive system** (2026-06-18). Three reported bugs
+  traced to one root cause + two missing designed features, all fixed:
+  1. **Stale users after disconnect + eternal PLC hiss** (root cause): `ConnSession::close()`
+     silently erased dropped users from the registry without broadcasting `UserEvent::LEFT`.
+     Peers never learned the user left → their user lists stayed stale AND their audio
+     engines never called `remove_stream` → Opus PLC synthesized comfort noise forever
+     (the "soft hissing that never goes away"). **Fix:** `SessionRegistry::broadcast_left()`
+     helper (mirrors `kick_user`'s first half); `ConnSession::close()` now broadcasts LEFT
+     before erasing. Regression test `test_disconnect_left` (`tests/`).
+  2. **PLC cap** (defense-in-depth): `AudioEngine::on_playback` now caps pure-PLC at ~2 s
+     (`kPlcCapSamples`); after that it emits digital silence instead of more comfort noise,
+     so a stale stream can never hiss forever even if `remove_stream` is never called. Resets
+     automatically when fresh packets arrive. Test `test_plc_cap` (`tests/`).
+  3. **No timeout / no ping** (missing feature): the client never sent `Ping`, the server had
+     no `last_seen` / reaper, and half-open connections (NAT timeout, wifi loss, sleep) left
+     ghost users forever. **Fix:** client sends `Ping` every 15 s from the io thread (RTT
+     measured from `Pong` nonce); `ConnSession::last_seen` bumped on every inbound TCP/UDP
+     frame; `asio::steady_timer` reaper sweeps every 15 s and drops sessions older than 45 s
+     (configurable via `server::Config::reaper_timeout_ms`/`reaper_sweep_ms`). Each drop
+     broadcasts LEFT via fix #1. Test `test_reaper_timeout` (`tests/`, 2 s timeout for fast
+     turnaround).
+  4. **UDP KEEPALIVE** (missing feature): client sends a plaintext `KEEPALIVE` frame every
+     5 s (`voice_frame.h::kFrameKeepalive`); server bumps `last_seen` + echoes back. Keeps
+     NAT bindings alive and lets media activity defer the reaper independently of TCP.
+  5. **Graceful client disconnect:** `vc_disconnect()` now sends `Disconnect{code=0}` when
+     fully authenticated (`VC_STATE_CONNECTED`): it queues the envelope, sets a
+     `graceful_disconnect_pending_` flag, and joins the io thread — the io thread's
+     `drain_sends()` sends the Disconnect, sees the flag, sets `io_stop_`, and exits
+     naturally (its cleanup handles `teardown_voice()` + socket close). No main-thread
+     socket close → no double-close race. Server handles client-sent `Disconnect`
+     (`handle_client_disconnect` → `close()` → immediate LEFT broadcast, no reaper/EOF
+     wait). In non-authenticated states, the original force-close path runs (with TOFU
+     unblock).
+  - Docs updated: `docs/protocol.md §6/§7` (graceful disconnect, pinned N=3, reaper, last_seen),
+    `docs/voice.md §6` (KEEPALIVE plaintext + echo + last_seen), `docs/architecture.md §5`
+    (reaper timer), `server::Config` (reaper fields). `ctest --preset m2-dev` — **21/21 green**
+    (3 new tests: disconnect_left, plc_cap, reaper_timeout).
+
 - **Done:** **Stereo screen-audio loopback capture on Windows** (2026-06-17). The WASAPI
   loopback path (`start_loopback_capture`) used to hardcode `cfg.capture.channels = 1`,
   downmixing the system's stereo mix to mono before the encoder ever saw it — so even on a
@@ -141,8 +179,10 @@ up instantly. Newest status at the top.
   response-vs-broadcast contract in `docs/protocol.md` §6. Registry-level admin broadcasts
   (move/mute/kick/channel CRUD) already used `exclude=0` and were correct. `ctest --test-dir
   build/m1-dev` — **18/18 green** (PowerShell); Windows `VoiceCat.App` builds 0 warnings.
-  **Latent, not fixed:** the client never sends the `Ping` keepalive that `docs/protocol.md` §7
-  describes (only the server answers pings) — unrelated to this bug, noted for later.
+  ~~**Latent, not fixed:** the client never sends the `Ping` keepalive that `docs/protocol.md` §7
+  describes (only the server answers pings) — unrelated to this bug, noted for later.~~
+  **Resolved** (2026-06-18): full keepalive/timeout/disconnect system implemented — see
+  "disconnect, timeout & keepalive" entry below.
 - **Done:** **Fixed a *second* silent-playback bug — the playout clock free-ran and drifted off
   the stream** (2026-06-17, reported live: both `vccli` and the Windows client showed `talking=1/0`
   correctly on VAD/PTT, mic + screen-share were recognized by peers, but nothing was audible).