fix(net): broadcast LEFT on disconnect, add keepalive/reaper, cap PLC hiss

Three reported bugs traced to one root cause plus two missing designed features:

1. Stale users + eternal PLC hiss (root cause): ConnSession::close() silently
   erased dropped users without broadcasting UserEvent::LEFT, so peers never
   learned the user left and their audio engines never called remove_stream —
   Opus PLC synthesized comfort noise forever. Fix: broadcast_left() helper
   + close() broadcasts LEFT before erasing.

2. PLC cap (defense-in-depth): on_playback now caps pure PLC at ~2s, then
   emits digital silence so a stale stream can never hiss forever even if
   remove_stream is skipped. Resets automatically on fresh packets.

3. No timeout / no ping: client never sent Ping, server had no last_seen /
   reaper, so half-open connections (NAT timeout, wifi loss, sleep) left
   ghost users forever. Fix: client Ping every 15s with RTT measurement,
   ConnSession::last_seen bumped on every inbound TCP/UDP frame, steady_timer
   reaper sweeps every 15s and drops sessions older than 45s (configurable
   via server::Config).

4. UDP KEEPALIVE: client sends plaintext kFrameKeepalive every 5s; server
   bumps last_seen + echoes back. Keeps NAT bindings alive and lets media
   activity defer the reaper independently of TCP.

5. Graceful client disconnect: vc_disconnect() sends Disconnect{code=0} via
   a flag-based io-thread exit (no double-close race); server handles
   client-sent Disconnect with immediate close() + LEFT broadcast.

3 new tests: disconnect_left, plc_cap, reaper_timeout. 21/21 ctest green.

Docs: protocol.md §6/§7, voice.md §6, architecture.md §5, PROGRESS.md.

server/src/conn_session.h

@@ -15,6 +15,7 @@
 
 #include <array>
 #include <atomic>
+#include <chrono>
 #include <cstdint>
 #include <functional>
 #include <memory>
@@ -82,12 +83,24 @@ class ConnSession : public std::enable_shared_from_this<ConnSession> {
     uint64_t session_id() const { return session_id_; }
     uint32_t user_id()    const { return user_id_; }
 
+    // Keepalive: bump last_seen to "now" on any inbound activity (TCP frame or UDP voice
+    // frame). The server's reaper sweeps sessions whose last_seen is older than the
+    // timeout (docs/protocol.md §7). Stored as steady_clock ms since epoch in an atomic so
+    // the reaper thread can read it lock-free.
+    void touch_last_seen() {
+        last_seen_ms_.store(std::chrono::duration_cast<std::chrono::milliseconds>(
+            std::chrono::steady_clock::now().time_since_epoch()).count(),
+            std::memory_order_release);
+    }
+    int64_t last_seen_ms() const { return last_seen_ms_.load(std::memory_order_acquire); }
+
    private:
     void handle_client_hello(uint64_t req_id, const voicecat::v1::ClientHello& msg);
     void handle_auth_request(uint64_t req_id, const voicecat::v1::AuthRequest& msg);
     void handle_join_channel(uint64_t req_id, const voicecat::v1::JoinChannelRequest& msg);
     void handle_text_message(const voicecat::v1::TextMessage& msg);
     void handle_ping(const voicecat::v1::Ping& msg);
+    void handle_client_disconnect(const voicecat::v1::Disconnect& msg);
     void handle_udp_binding(uint64_t req_id, const voicecat::v1::UdpBinding& msg);
     void handle_stream_announce(uint64_t req_id, const voicecat::v1::StreamAnnounce& msg);
     void handle_stream_stop(const voicecat::v1::StreamStop& msg);
@@ -136,6 +149,11 @@ class ConnSession : public std::enable_shared_from_this<ConnSession> {
     std::atomic<uint32_t> user_id_{0};
     std::atomic<bool>  closed_{false};
 
+    // Keepalive: steady_clock ms since epoch of the last inbound activity. Bumped by
+    // touch_last_seen() on every on_frame() and (via media_relay) on every UDP voice frame.
+    // The reaper (server.cpp) drops sessions whose last_seen is older than 45s.
+    std::atomic<int64_t> last_seen_ms_{0};
+
     // M2 UDP / media
     std::array<uint8_t, 16>  udp_token_{};
     mutable std::mutex        udp_ep_mu_;