fix(net): broadcast LEFT on disconnect, add keepalive/reaper, cap PLC hiss

Three reported bugs traced to one root cause plus two missing designed features:

1. Stale users + eternal PLC hiss (root cause): ConnSession::close() silently
   erased dropped users without broadcasting UserEvent::LEFT, so peers never
   learned the user left and their audio engines never called remove_stream —
   Opus PLC synthesized comfort noise forever. Fix: broadcast_left() helper
   + close() broadcasts LEFT before erasing.

2. PLC cap (defense-in-depth): on_playback now caps pure PLC at ~2s, then
   emits digital silence so a stale stream can never hiss forever even if
   remove_stream is skipped. Resets automatically on fresh packets.

3. No timeout / no ping: client never sent Ping, server had no last_seen /
   reaper, so half-open connections (NAT timeout, wifi loss, sleep) left
   ghost users forever. Fix: client Ping every 15s with RTT measurement,
   ConnSession::last_seen bumped on every inbound TCP/UDP frame, steady_timer
   reaper sweeps every 15s and drops sessions older than 45s (configurable
   via server::Config).

4. UDP KEEPALIVE: client sends plaintext kFrameKeepalive every 5s; server
   bumps last_seen + echoes back. Keeps NAT bindings alive and lets media
   activity defer the reaper independently of TCP.

5. Graceful client disconnect: vc_disconnect() sends Disconnect{code=0} via
   a flag-based io-thread exit (no double-close race); server handles
   client-sent Disconnect with immediate close() + LEFT broadcast.

3 new tests: disconnect_left, plc_cap, reaper_timeout. 21/21 ctest green.

Docs: protocol.md §6/§7, voice.md §6, architecture.md §5, PROGRESS.md.

server/src/media_relay.cpp

@@ -130,7 +130,20 @@ void MediaRelay::on_udp_frame(const uint8_t* data, size_t len,
         return;
     }
 
-    // kFrameKeepalive or unknown: silently discard.
+    if (frame_type == voicecat::net::kFrameKeepalive) {
+        // Plaintext KEEPALIVE (docs/voice.md §6): identify the sender by its verified UDP
+        // endpoint, bump last_seen so the reaper doesn't drop a client whose TCP control
+        // channel is idle but whose media path is alive, and echo the keepalive back so the
+        // client can measure media-path RTT/loss independently of the TCP ping.
+        auto session = registry_->find_by_udp_endpoint(sender);
+        if (!session) return;
+        session->touch_last_seen();
+        // Echo back to the sender (same plaintext header).
+        udp_.send_to(data, len, sender);
+        return;
+    }
+
+    // Unknown frame type: silently discard.
 }
 
 }  // namespace voicecat::server