fix(net): broadcast LEFT on disconnect, add keepalive/reaper, cap PLC hiss

Three reported bugs traced to one root cause plus two missing designed features:

1. Stale users + eternal PLC hiss (root cause): ConnSession::close() silently
   erased dropped users without broadcasting UserEvent::LEFT, so peers never
   learned the user left and their audio engines never called remove_stream —
   Opus PLC synthesized comfort noise forever. Fix: broadcast_left() helper
   + close() broadcasts LEFT before erasing.

2. PLC cap (defense-in-depth): on_playback now caps pure PLC at ~2s, then
   emits digital silence so a stale stream can never hiss forever even if
   remove_stream is skipped. Resets automatically on fresh packets.

3. No timeout / no ping: client never sent Ping, server had no last_seen /
   reaper, so half-open connections (NAT timeout, wifi loss, sleep) left
   ghost users forever. Fix: client Ping every 15s with RTT measurement,
   ConnSession::last_seen bumped on every inbound TCP/UDP frame, steady_timer
   reaper sweeps every 15s and drops sessions older than 45s (configurable
   via server::Config).

4. UDP KEEPALIVE: client sends plaintext kFrameKeepalive every 5s; server
   bumps last_seen + echoes back. Keeps NAT bindings alive and lets media
   activity defer the reaper independently of TCP.

5. Graceful client disconnect: vc_disconnect() sends Disconnect{code=0} via
   a flag-based io-thread exit (no double-close race); server handles
   client-sent Disconnect with immediate close() + LEFT broadcast.

3 new tests: disconnect_left, plc_cap, reaper_timeout. 21/21 ctest green.

Docs: protocol.md §6/§7, voice.md §6, architecture.md §5, PROGRESS.md.

server/src/server.cpp

@@ -8,7 +8,10 @@
 #include <asio.hpp>
 #include <asio/signal_set.hpp>
 
+#include <chrono>
+#include <functional>
 #include <memory>
+#include <vector>
 
 #include "conn_session.h"
 #include "core/worker_pool.h"
@@ -148,6 +151,32 @@ int Server::run() {
         io.stop();
     });
 
+    // ── Keepalive reaper (docs/protocol.md §7) ─────────────────────────────────
+    // Sweeps every reaper_sweep_ms and drops any session whose last_seen is older than
+    // reaper_timeout_ms. Each close() broadcasts UserEvent::LEFT via the Tier 1 fix, so
+    // peers learn about the timeout exactly like a normal disconnect — their audio engines
+    // call remove_stream and stop PLC. This catches half-open connections (NAT timeout,
+    // wifi loss without RST, laptop sleep) that never produce a TCP EOF and would otherwise
+    // leave ghost users forever. Disabled when reaper_timeout_ms <= 0.
+    asio::steady_timer reaper_timer(io);
+    std::function<void()> arm_reaper;
+    if (cfg_.reaper_timeout_ms > 0) {
+        arm_reaper = [&] {
+            reaper_timer.expires_after(std::chrono::milliseconds(cfg_.reaper_sweep_ms));
+            reaper_timer.async_wait([&](std::error_code ec) {
+                if (ec || io.stopped()) return;
+                for (auto& sess : registry->find_stale_sessions(cfg_.reaper_timeout_ms)) {
+                    std::printf("[server] reaper: dropping stale session %llu (user %u)\n",
+                                static_cast<unsigned long long>(sess->session_id()),
+                                sess->user_id());
+                    sess->close();
+                }
+                arm_reaper();
+            });
+        };
+        arm_reaper();
+    }
+
     std::printf("[voicecat-server] %s — TCP :%u  UDP :%u\n",
                 cfg_.server_name.c_str(), bound, media_bound);
     std::printf("[voicecat-server] fingerprint: %s\n",