fix(net): broadcast LEFT on disconnect, add keepalive/reaper, cap PLC hiss

Three reported bugs traced to one root cause plus two missing designed features:

1. Stale users + eternal PLC hiss (root cause): ConnSession::close() silently
   erased dropped users without broadcasting UserEvent::LEFT, so peers never
   learned the user left and their audio engines never called remove_stream —
   Opus PLC synthesized comfort noise forever. Fix: broadcast_left() helper
   + close() broadcasts LEFT before erasing.

2. PLC cap (defense-in-depth): on_playback now caps pure PLC at ~2s, then
   emits digital silence so a stale stream can never hiss forever even if
   remove_stream is skipped. Resets automatically on fresh packets.

3. No timeout / no ping: client never sent Ping, server had no last_seen /
   reaper, so half-open connections (NAT timeout, wifi loss, sleep) left
   ghost users forever. Fix: client Ping every 15s with RTT measurement,
   ConnSession::last_seen bumped on every inbound TCP/UDP frame, steady_timer
   reaper sweeps every 15s and drops sessions older than 45s (configurable
   via server::Config).

4. UDP KEEPALIVE: client sends plaintext kFrameKeepalive every 5s; server
   bumps last_seen + echoes back. Keeps NAT bindings alive and lets media
   activity defer the reaper independently of TCP.

5. Graceful client disconnect: vc_disconnect() sends Disconnect{code=0} via
   a flag-based io-thread exit (no double-close race); server handles
   client-sent Disconnect with immediate close() + LEFT broadcast.

3 new tests: disconnect_left, plc_cap, reaper_timeout. 21/21 ctest green.

Docs: protocol.md §6/§7, voice.md §6, architecture.md §5, PROGRESS.md.

server/src/session_registry.h

@@ -66,6 +66,12 @@ class SessionRegistry {
     // Remove a user (called on disconnect after auth).
     void remove_user(uint32_t user_id);
 
+    // Broadcast a UserEvent::LEFT for a user to all other sessions. Called by
+    // ConnSession::close() before remove_user() so remaining clients learn about an
+    // ungraceful disconnect (TCP drop, crash, network loss). Mirrors the first half of
+    // kick_user(). Takes the shared lock internally; safe to call from ConnSession::close.
+    void broadcast_left(uint32_t user_id, const std::string& reason);
+
     // Move a user to a channel. Returns false if channel doesn't exist.
     bool set_user_channel(uint32_t user_id, uint32_t channel_id);
 
@@ -82,6 +88,12 @@ class SessionRegistry {
     // Broadcast an envelope to all sessions except the excluded one.
     void broadcast(const voicecat::v1::Envelope& env, uint64_t exclude_session_id = 0) const;
 
+    // Return all sessions whose last_seen is older than max_age_ms (steady_clock ms), i.e.
+    // have not had any inbound TCP or UDP activity in that span. The reaper (server.cpp)
+    // calls close() on each — which broadcasts UserEvent::LEFT via the Tier 1 fix. Locks
+    // only to collect the list; close() runs outside the lock (mirrors kick_user's pattern).
+    std::vector<std::shared_ptr<ConnSession>> find_stale_sessions(int64_t max_age_ms) const;
+
    private:
     void broadcast_unlocked(const voicecat::v1::Envelope& env,
                             uint64_t exclude_session_id = 0) const;