fix(media): stop permanent voice loss after bad-network blip (protocol v2)

A bad UDP packet on a flaky link could permanently wedge the voice path,
unrecoverable even across app restarts. Three defects:

1. Anti-replay window was advanced from the UNAUTHENTICATED header seq
   before the AEAD tag was checked, and not rolled back on failure. One
   corrupted/forged frame shoved recv_highest_ far ahead, after which every
   legitimate frame was rejected as "too old" forever. Reorder to
   replay-check -> authenticate -> update (RFC 3711 3.3); the window now
   moves only after a successful tag check.

2. The wire seq was only the low 16 bits of the nonce counter (zero-extended
   on receive). After 65,536 frames the nonce desynced and all frames failed
   auth. Widen the voice frame seq u16 -> u64 (header 14 -> 20 bytes). The
   core owns all UDP framing, so Swift/C# clients need only a rebuild. This
   is a versioned wire change: VOICECAT_PROTOCOL_VERSION 1 -> 2, handshake
   rejects on mismatch.

3. Server leaked per-session UDP state on disconnect; unregister_session now
   frees udp_endpoints_/udp_tokens_/ssrc_to_session_.

Also add rate-limited dropped-frame logging to MediaRelay so a wedged media
path is observable. New regression tests in test_media_aead.cpp cover the
poison (fails on old code) and the 16-bit wrap. ctest --preset dev
-E external_pcm: 22/22 pass (external_pcm aborts on a pre-existing CoreAudio
shutdown race, unrelated).

docs/security.md

@@ -89,8 +89,13 @@ the design depends on that.
 - **Nonce discipline:** `nonce = direction_bit ‖ ssrc ‖ monotonic_packet_counter`. The
   counter never repeats under one key; the session **rekeys** (re-derives via the exporter
   with a bumped epoch) well before counter exhaustion or on a time/byte budget.
-- **Anti-replay:** a sliding-window replay filter per ssrc (à la IPsec) keyed on the packet
-  counter. Replays and out-of-window packets are dropped before decode.
+- **Anti-replay:** a 64-bit sliding-window replay filter keyed on the packet counter (à la
+  IPsec). The window is **advanced only after the AEAD tag verifies** (RFC 3711 §3.3 order:
+  replay-check → authenticate → update). The counter is read from the unauthenticated
+  header, so advancing the high-water mark *before* authentication would let a single
+  corrupted or forged packet jump it far ahead, after which every legitimate packet is
+  rejected as "too old" — a permanent denial of the whole stream. Failed-auth packets leave
+  the window untouched. Replays and out-of-window packets are dropped before decode.
 
 ## 3. UDP session binding