fix(net): broadcast LEFT on disconnect, add keepalive/reaper, cap PLC hiss

Three reported bugs traced to one root cause plus two missing designed features:

1. Stale users + eternal PLC hiss (root cause): ConnSession::close() silently
   erased dropped users without broadcasting UserEvent::LEFT, so peers never
   learned the user left and their audio engines never called remove_stream —
   Opus PLC synthesized comfort noise forever. Fix: broadcast_left() helper
   + close() broadcasts LEFT before erasing.

2. PLC cap (defense-in-depth): on_playback now caps pure PLC at ~2s, then
   emits digital silence so a stale stream can never hiss forever even if
   remove_stream is skipped. Resets automatically on fresh packets.

3. No timeout / no ping: client never sent Ping, server had no last_seen /
   reaper, so half-open connections (NAT timeout, wifi loss, sleep) left
   ghost users forever. Fix: client Ping every 15s with RTT measurement,
   ConnSession::last_seen bumped on every inbound TCP/UDP frame, steady_timer
   reaper sweeps every 15s and drops sessions older than 45s (configurable
   via server::Config).

4. UDP KEEPALIVE: client sends plaintext kFrameKeepalive every 5s; server
   bumps last_seen + echoes back. Keeps NAT bindings alive and lets media
   activity defer the reaper independently of TCP.

5. Graceful client disconnect: vc_disconnect() sends Disconnect{code=0} via
   a flag-based io-thread exit (no double-close race); server handles
   client-sent Disconnect with immediate close() + LEFT broadcast.

3 new tests: disconnect_left, plc_cap, reaper_timeout. 21/21 ctest green.

Docs: protocol.md §6/§7, voice.md §6, architecture.md §5, PROGRESS.md.

server/src/conn_session.cpp

@@ -59,10 +59,12 @@ void ConnSession::set_io(SendFn send_fn, CloseFn close_fn) {
 }
 
 void ConnSession::begin() {
+    touch_last_seen();
     // Nothing to do at TCP level — wait for ClientHello
 }
 
 void ConnSession::on_frame(std::vector<uint8_t> frame) {
+    touch_last_seen();  // any inbound TCP activity keeps this session off the reaper's list
     voicecat::v1::Envelope env;
     if (!protocol::decode_envelope(frame, env)) return;
 
@@ -87,6 +89,12 @@ void ConnSession::on_frame(std::vector<uint8_t> frame) {
         case voicecat::v1::Envelope::kPing:
             handle_ping(env.ping());
             break;
+        case voicecat::v1::Envelope::kDisconnect:
+            // Client-initiated graceful disconnect (code=0). Falls through to close() which
+            // broadcasts UserEvent::LEFT — same as a TCP drop, but immediate (no reaper/EOF
+            // wait). Gated on Authenticated so a pre-auth stray Disconnect can't skip cleanup.
+            if (st == State::Authenticated) handle_client_disconnect(env.disconnect());
+            break;
         case voicecat::v1::Envelope::kLeaveChannel:
             if (st == State::Authenticated)
                 handle_leave_channel();
@@ -172,7 +180,19 @@ void ConnSession::close() {
     if (closed_.exchange(true)) return;
     state_.store(State::Disconnecting, std::memory_order_release);
     uint32_t uid = user_id_.load();
-    if (uid) registry_->remove_user(uid);
+    if (uid) {
+        // Broadcast LEFT BEFORE erasing the user, so remaining clients (and the audio
+        // engine's remove_stream path on each peer) learn about the departure. This
+        // covers ungraceful disconnects (TCP drop, crash, network loss) that previously
+        // silently erased the user from the registry without notifying anyone — which
+        // left stale users in peer client lists and kept Opus PLC hissing forever on
+        // peers whose remove_stream was never triggered. Mirrors kick_user's first half
+        // (session_registry.cpp kick_user). broadcast_left releases its shared_lock
+        // before remove_user acquires the unique_lock, so no deadlock; and send_envelope
+        // on this session is a no-op now that closed_ is true.
+        registry_->broadcast_left(uid, "");
+        registry_->remove_user(uid);
+    }
     if (session_id_) registry_->unregister_session(session_id_);
     if (close_fn_) close_fn_();
 }
@@ -475,6 +495,15 @@ void ConnSession::handle_ping(const voicecat::v1::Ping& msg) {
     send_envelope(env);
 }
 
+void ConnSession::handle_client_disconnect(const voicecat::v1::Disconnect& /*msg*/) {
+    // Graceful client-initiated disconnect (code=0). close() broadcasts UserEvent::LEFT and
+    // cleans up the registry — identical to the TCP-drop path, but triggered by the client's
+    // explicit goodbye so peers learn about the departure immediately (no reaper timeout,
+    // no EOF detection delay). Idempotent: the closed_ guard in close() handles the
+    // inevitable follow-up TCP EOF when the client closes its socket.
+    close();
+}
+
 void ConnSession::handle_udp_binding(uint64_t req_id, const voicecat::v1::UdpBinding& msg) {
     if (msg.ack()) return;  // server→client direction; ignore if echoed back