docs(core): backfill //! module docs on quic/{io,endpoint,pake}

The last three //!-less modules in the tree (plan §2.5 / §3.2):
  - io:       length-prefixed control-message framing (read_msg/write_msg)
  - endpoint: QUIC endpoint construction + transport tuning + the TOFU
              cert-pinning verifier (PinVerify)
  - pake:     SPAKE2 pairing key exchange

Docs only — no code, type, or wire-format change (cbindgen header byte-identical).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-core/src/quic/endpoint.rs

@@ -1,3 +1,5 @@
+//! Shared QUIC endpoint construction (host + client) and transport tuning — keep-alive and idle
+//! timeout, certificate-fingerprint helpers, and the TOFU cert-pinning verifier (`PinVerify`).
 use std::sync::{Arc, Mutex};
 
 /// Shared QUIC transport tuning for BOTH the host and client endpoints. Keep-alive is the

crates/punktfunk-core/src/quic/io.rs

@@ -1,3 +1,5 @@
+//! Length-prefixed framing for QUIC control-stream messages: a `u16` length header followed by the
+//! payload, bounded at 64 KiB (control messages are tiny).
 /// Read one framed message (bounded at 64 KiB — control messages are tiny).
 pub async fn read_msg(recv: &mut quinn::RecvStream) -> std::io::Result<Vec<u8>> {
     let mut len = [0u8; 2];

crates/punktfunk-core/src/quic/pake.rs

@@ -1,3 +1,5 @@
+//! SPAKE2 password-authenticated key exchange for pairing: derive a shared key from the PIN and
+//! confirm it against both certificate fingerprints.
 use crate::error::{PunktfunkError, Result};
 use hmac::{Hmac, Mac};
 use spake2::{Ed25519Group, Identity, Password, Spake2};