Start .NET rewrite with wire and media crypto conformance

docs/voice.md

@@ -66,9 +66,10 @@ payload      one Opus packet (the encoder's output for one frame)
 > interoperate; the `Hello` handshake rejects on `proto_version` mismatch.
 
 This is intentionally RTP-shaped (familiar semantics: ssrc/seq/timestamp) without RTP's
-full machinery. The **server relays the payload unmodified** — it only reads the header to
-route by ssrc→channel and may restamp nothing (the client's ssrc is globally unique once
-assigned at `StreamAnnounce`). No server-side decode.
+full machinery. The server authenticates/decrypts each incoming packet and reseals its
+encoded Opus bytes for each recipient using that recipient's directional key and send
+counter. SSRC, timestamp, flags, and codec pass through; sequence and ciphertext/tag change.
+There is no server-side audio decoding or transcoding.
 
 ### Why client-sends-ssrc is safe
 
@@ -183,7 +184,7 @@ Each receiver keeps an **adaptive jitter buffer per ssrc** with **bounded-depth
 
 - A `KEEPALIVE` (type 2) frame flows both directions on the media channel every ~5 s to
   hold NAT bindings and measure media-path RTT/loss independent of TCP. The frame is
-  plaintext (14-byte header, no payload, no AEAD) — the server identifies the sender by
+  plaintext (20-byte header, no payload, no AEAD) — the server identifies the sender by
   its already-verified UDP endpoint (established during the `UdpBinding` handshake). On
   receipt the server bumps the sender's `last_seen` (so media activity defers the TCP
   reaper independently of control-channel traffic) and echoes the frame back so the