feat: add evidence-gated NAT traversal alpha

[ovasylenko]

Outcome

Implements all four alpha-readiness opportunities as one evidence-driven step:

• RFC 8489 Binding on the same reserved UDP match socket
• bounded host/reflexive candidate punching with room/session-bound packets
• redacted NAT/candidate/punch evidence in canonical reports
• automated 8-of-10 campaign gate and compatibility matrix CLI
• Windows CI artifact includes the campaign summarizer
• physical same-LAN and different-NAT campaign runbook
• ADR 0002 plus a typed BlockedNoPublicInterface FBNeo capability

Toolchain and dependency modernization

• Rust 1.98.0, edition 2024, and a pinned rust-toolchain.toml
• Tauri 2.11, Axum 0.8, SQLx 0.9, Tokio 1.53, ts-rs 12, and current stable Rust dependencies
• Node 24, pnpm 11.23, TypeScript 7, React 19, Vite 8/Oxc, Vitest 4, Zustand 5, and current workspace dependencies
• migrated Tauri v2 capabilities/config/IPC APIs and Axum v0.8 route captures
• upgraded the newly merged relay workspace member to Rust 1.98/Axum 0.8 and repaired both Docker build graphs
• synchronized with Zendevve/OpenCade:main and preserved both the upstream relay/NAT work and the evidence-grade RFC 8489 path

Verification

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo test --workspace --all-features --locked against isolated PostgreSQL 16 (116 tests)
• desktop Cargo check/Clippy and native tauri build --debug --no-bundle
• pnpm format:check, pnpm typecheck, pnpm test (44 tests), and pnpm build
• protocol binding generation/drift gate
• docker compose config
• production server and relay Docker image builds
• RustSec audit: no known vulnerabilities; npm production audit: no known vulnerabilities
• duplicate push/PR GitHub Actions runs: Web, Linux Rust, and Windows desktop all green

Evidence boundary

No physical two-Windows result is claimed. The implementation packages the binaries, report schema, verifier, campaign summarizer, and exact 5 LAN + 5 different-NAT workflow. Cone/symmetric classification and proven relay fallback remain gated on real campaign evidence. A single STUN Binding response is reported only as open, mapped, unknown, or blocked.

Companion fork PR: ovasylenko#4