fix(net): broadcast LEFT on disconnect, add keepalive/reaper, cap PLC hiss

Three reported bugs traced to one root cause plus two missing designed features:

1. Stale users + eternal PLC hiss (root cause): ConnSession::close() silently
   erased dropped users without broadcasting UserEvent::LEFT, so peers never
   learned the user left and their audio engines never called remove_stream —
   Opus PLC synthesized comfort noise forever. Fix: broadcast_left() helper
   + close() broadcasts LEFT before erasing.

2. PLC cap (defense-in-depth): on_playback now caps pure PLC at ~2s, then
   emits digital silence so a stale stream can never hiss forever even if
   remove_stream is skipped. Resets automatically on fresh packets.

3. No timeout / no ping: client never sent Ping, server had no last_seen /
   reaper, so half-open connections (NAT timeout, wifi loss, sleep) left
   ghost users forever. Fix: client Ping every 15s with RTT measurement,
   ConnSession::last_seen bumped on every inbound TCP/UDP frame, steady_timer
   reaper sweeps every 15s and drops sessions older than 45s (configurable
   via server::Config).

4. UDP KEEPALIVE: client sends plaintext kFrameKeepalive every 5s; server
   bumps last_seen + echoes back. Keeps NAT bindings alive and lets media
   activity defer the reaper independently of TCP.

5. Graceful client disconnect: vc_disconnect() sends Disconnect{code=0} via
   a flag-based io-thread exit (no double-close race); server handles
   client-sent Disconnect with immediate close() + LEFT broadcast.

3 new tests: disconnect_left, plc_cap, reaper_timeout. 21/21 ctest green.

Docs: protocol.md §6/§7, voice.md §6, architecture.md §5, PROGRESS.md.

core/src/audio/audio_engine.cpp

@@ -26,6 +26,16 @@ int64_t now_ms() {
 constexpr int32_t kResyncAheadSamples  = 48000 * 200 / 1000;  // clock 200 ms ahead → re-seed
 constexpr int32_t kResyncBehindSamples = 48000 * 500 / 1000;  // clock 500 ms behind → re-seed
 
+// PLC cap: after this many consecutive samples of pure packet-loss concealment (no real
+// packet decoded), stop calling opus_decode(nullptr,0,...) and emit silence instead. Opus
+// PLC synthesizes soft comfort noise that never "exhausts" (opus_decode always returns
+// frame_samples > 0 for PLC), so without a cap a stale stream left in the mixer after its
+// source disconnects would hiss forever. 2 s bounds the hiss to a brief gap while still
+// bridging normal network jitter/PTT silences. The primary fix for stale streams is the
+// server's UserEvent::LEFT broadcast (which triggers remove_stream); this is
+// defense-in-depth against any future regression that skips remove_stream.
+constexpr int32_t kPlcCapSamples = 48000 * 2;  // 2 s @ 48 kHz
+
 #ifdef VOICECAT_HAS_AUDIO
 // device_id encoding (DeviceInfo::id / AudioParams::*_device_id): a hex string of the raw
 // ma_device_id bytes. Opaque on purpose — names aren't guaranteed unique, and this is the only
@@ -459,8 +469,18 @@ void AudioEngine::on_playback(int16_t* out, ma_uint32 frames) {
                     maybe_frame->payload.data(),
                     static_cast<int>(maybe_frame->payload.size()),
                     stream.decode_scratch.data(), frame_samples);
+                stream.plc_samples_since_real = 0;  // real packet — reset PLC streak
+            } else if (stream.plc_samples_since_real >= kPlcCapSamples) {
+                // PLC cap exhausted: emit silence instead of more comfort noise. Keeps the
+                // ring fed and the playout clock advancing so timing is correct if the
+                // source resumes, but bounds the hiss to ~2 s (kPlcCapSamples).
+                std::memset(stream.decode_scratch.data(), 0,
+                            static_cast<size_t>(frame_samples) * stream.ring_channels *
+                                sizeof(int16_t));
+                n = frame_samples;
             } else {
                 n = stream.decoder.decode(nullptr, 0, stream.decode_scratch.data(), frame_samples);
+                if (n > 0) stream.plc_samples_since_real += n;  // track PLC streak
             }
             if (n <= 0) break;  // decoder error/exhausted PLC; rest of this period stays silent
 

core/src/audio/audio_engine.h

@@ -317,6 +317,14 @@ class AudioEngine {
         // dropped/never-due (silent playback). false until the first frame seeds it (on_playback).
         bool             playout_started = false;
 
+        // PLC cap (defense-in-depth): consecutive samples produced by packet-loss
+        // concealment since the last real decoded frame. Reset to 0 on every real frame.
+        // When it exceeds kPlcCapSamples (audio_engine.cpp), on_playback stops calling
+        // opus_decode(nullptr,0,...) and emits silence instead — bounding the comfort-noise
+        // hiss to ~2 s so a stale stream can never hiss forever even if remove_stream is
+        // never called. See on_playback's decode loop.
+        int64_t          plc_samples_since_real = 0;
+
         // M3: listener-chosen, local-only noise reduction (docs/voice.md §10). Lazily
         // created only when enabled — bounded by how many remote streams this listener
         // subscribes to, so no separate instance cap is needed.