fix(net): broadcast LEFT on disconnect, add keepalive/reaper, cap PLC hiss

Three reported bugs traced to one root cause plus two missing designed features:

1. Stale users + eternal PLC hiss (root cause): ConnSession::close() silently
   erased dropped users without broadcasting UserEvent::LEFT, so peers never
   learned the user left and their audio engines never called remove_stream —
   Opus PLC synthesized comfort noise forever. Fix: broadcast_left() helper
   + close() broadcasts LEFT before erasing.

2. PLC cap (defense-in-depth): on_playback now caps pure PLC at ~2s, then
   emits digital silence so a stale stream can never hiss forever even if
   remove_stream is skipped. Resets automatically on fresh packets.

3. No timeout / no ping: client never sent Ping, server had no last_seen /
   reaper, so half-open connections (NAT timeout, wifi loss, sleep) left
   ghost users forever. Fix: client Ping every 15s with RTT measurement,
   ConnSession::last_seen bumped on every inbound TCP/UDP frame, steady_timer
   reaper sweeps every 15s and drops sessions older than 45s (configurable
   via server::Config).

4. UDP KEEPALIVE: client sends plaintext kFrameKeepalive every 5s; server
   bumps last_seen + echoes back. Keeps NAT bindings alive and lets media
   activity defer the reaper independently of TCP.

5. Graceful client disconnect: vc_disconnect() sends Disconnect{code=0} via
   a flag-based io-thread exit (no double-close race); server handles
   client-sent Disconnect with immediate close() + LEFT broadcast.

3 new tests: disconnect_left, plc_cap, reaper_timeout. 21/21 ctest green.

Docs: protocol.md §6/§7, voice.md §6, architecture.md §5, PROGRESS.md.

docs/architecture.md

@@ -197,6 +197,10 @@ Design notes:
   and presence can be subscribed more broadly. This keeps fan-out bounded on big servers.
 - **Stateless-ish media.** UDP carries no auth per packet beyond the media-AEAD session;
   the 5-tuple→session binding is established once via a token (see protocol.md §4).
+- **Keepalive reaper.** An `asio::steady_timer` sweeps every 15 s and drops any session
+  whose `last_seen` (bumped on every inbound TCP or UDP frame) is older than 45 s. Each
+  drop broadcasts `UserEvent::LEFT` so peers clean up immediately. This catches half-open
+  connections that never produce a TCP EOF. Configurable via `server::Config`.
 - **Single process, scalable later.** v1 is one process, one machine. The session registry
   and router are written behind interfaces so a future build can sit them behind a shared
   bus for multi-node, but that is explicitly out of scope for now.

docs/protocol.md

@@ -274,6 +274,8 @@ message TextMessage {
   user, kick, ban, server-mute, set-permission, create/reset/delete account). Error `code`s
   are an enumerated, stable list.
 - Fatal conditions send **`Disconnect { code; reason }`** then close the TLS connection.
+  `code ≥ 1` is server-sent (1 = protocol error, 2 = kicked). `code = 0` is client-sent
+  graceful disconnect (§7): the server broadcasts `UserEvent::LEFT` and closes immediately.
 - **The response is for the request; the broadcast is for the state.** A `*Result` only
   acknowledges the actor's request (correlation via `request_id`, error text, and any
   actor-private payload — e.g. the channel `AudioConfig` in `JoinChannelResult`). The
@@ -285,10 +287,27 @@ message TextMessage {
 
 ## 7. Keepalive & timeouts
 
-- **TCP:** `Ping`/`Pong` every ~15 s; missing N consecutive pongs → drop. `Pong` echoes the
-  `Ping` nonce so RTT is measurable.
+- **TCP:** `Ping`/`Pong` every ~15 s; missing 3 consecutive pongs (45 s) → the server's
+  reaper drops the session. `Pong` echoes the `Ping` nonce so RTT is measurable. The
+  client sends `Ping` automatically from its io thread; the server answers with `Pong`
+  in any state.
+- **`last_seen` reaper.** Every `ConnSession` tracks `last_seen` — bumped on *any*
+  inbound TCP frame (not just `Ping`) and on any inbound UDP voice/keepalive frame. A
+  periodic sweep (`asio::steady_timer`, every 15 s) drops sessions whose `last_seen` is
+  older than 45 s. Each drop calls `close()`, which broadcasts `UserEvent::LEFT` to
+  remaining clients — so half-open connections (NAT timeout, wifi loss without RST,
+  laptop sleep) that never produce a TCP EOF are cleaned up, and peers' audio engines
+  `remove_stream` and stop PLC. The timeout and sweep interval are configurable via
+  `server::Config::reaper_timeout_ms` / `reaper_sweep_ms` (set to 0 to disable).
 - **UDP:** a separate lightweight keepalive on the media channel (voice.md §6) keeps NAT
   bindings alive and detects media-path failure independently of the control channel.
+- **Graceful disconnect.** A client ending its session sends `Disconnect { code = 0;
+  reason }` before closing the socket. The server calls `close()` on receipt —
+  broadcasting `UserEvent::LEFT` immediately, without waiting for TCP EOF or the reaper.
+  The client's `vc_disconnect()` queues this message and waits for the io thread to flush
+  it before closing the socket. `code = 0` is reserved for client-initiated graceful
+  disconnect; server-sent fatal `Disconnect` uses `code ≥ 1` (1 = protocol error,
+  2 = kicked).
 
 ## 8. Extensibility checklist
 

docs/voice.md

@@ -137,7 +137,12 @@ Each receiver keeps an **adaptive jitter buffer per ssrc**.
 ## 6. UDP keepalive & NAT
 
 - A `KEEPALIVE` (type 2) frame flows both directions on the media channel every ~5 s to
-  hold NAT bindings and measure media-path RTT/loss independent of TCP.
+  hold NAT bindings and measure media-path RTT/loss independent of TCP. The frame is
+  plaintext (14-byte header, no payload, no AEAD) — the server identifies the sender by
+  its already-verified UDP endpoint (established during the `UdpBinding` handshake). On
+  receipt the server bumps the sender's `last_seen` (so media activity defers the TCP
+  reaper independently of control-channel traffic) and echoes the frame back so the
+  client can measure media-path RTT.
 - If the media path dies but TCP is alive, the client surfaces a "voice disconnected"
   state and attempts UDP re-binding (re-derive media keys + fresh `UdpBinding`) without dropping
   the control session.