fix(media): stop permanent voice loss after bad-network blip (protocol v2)

A bad UDP packet on a flaky link could permanently wedge the voice path,
unrecoverable even across app restarts. Three defects:

1. Anti-replay window was advanced from the UNAUTHENTICATED header seq
   before the AEAD tag was checked, and not rolled back on failure. One
   corrupted/forged frame shoved recv_highest_ far ahead, after which every
   legitimate frame was rejected as "too old" forever. Reorder to
   replay-check -> authenticate -> update (RFC 3711 3.3); the window now
   moves only after a successful tag check.

2. The wire seq was only the low 16 bits of the nonce counter (zero-extended
   on receive). After 65,536 frames the nonce desynced and all frames failed
   auth. Widen the voice frame seq u16 -> u64 (header 14 -> 20 bytes). The
   core owns all UDP framing, so Swift/C# clients need only a rebuild. This
   is a versioned wire change: VOICECAT_PROTOCOL_VERSION 1 -> 2, handshake
   rejects on mismatch.

3. Server leaked per-session UDP state on disconnect; unregister_session now
   frees udp_endpoints_/udp_tokens_/ssrc_to_session_.

Also add rate-limited dropped-frame logging to MediaRelay so a wedged media
path is observable. New regression tests in test_media_aead.cpp cover the
poison (fails on old code) and the 16-bit wrap. ctest --preset dev
-E external_pcm: 22/22 pass (external_pcm aborts on a pre-existing CoreAudio
shutdown race, unrelated).

server/src/session_registry.cpp

@@ -100,6 +100,22 @@ void SessionRegistry::unregister_session(uint64_t session_id) {
     std::unique_lock lk(mu_);
     sessions_.erase(session_id);
     session_permissions_.erase(session_id);
+
+    // Free the per-session UDP/media state too. These maps are keyed by
+    // endpoint/token/ssrc (not session id), so scan-and-erase by value. Leaving them
+    // behind leaks entries and lets a stale endpoint/token resolve toward a dead
+    // session across reconnects (e.g. a wifi-handoff rebind from a new port).
+    auto erase_by_value = [session_id](auto& map) {
+        for (auto it = map.begin(); it != map.end();) {
+            if (it->second == session_id)
+                it = map.erase(it);
+            else
+                ++it;
+        }
+    };
+    erase_by_value(udp_endpoints_);
+    erase_by_value(udp_tokens_);
+    erase_by_value(ssrc_to_session_);
 }
 
 uint32_t SessionRegistry::add_user(uint64_t session_id, const voicecat::v1::User& user) {