feat(punktfunk1): configurable data-plane UDP port (--data-port)

The native data plane used a random ephemeral UDP port (hole-punched), which a
strict firewall can't pre-open — so remote clients behind one couldn't connect.
Add an optional fixed data port:

- `Punktfunk1Options`/`NativeServe` gain `data_port`; `bind_data_socket` binds the
  fixed port (→ direct, no hole-punch) or falls back to a random port + hole-punch
  when unset or the fixed port is busy (a concurrent session already holds it).
- `UdpTransport::from_socket`/`from_socket_punch` adopt an already-bound socket, so
  the host keeps the SAME data socket from handshake through streaming — no
  drop-then-rebind window in which a concurrent session could steal a fixed port.
- `main.rs` wires the CLI flag through to `NativeServe`.
- Firewall docs updated (troubleshooting.md + apt/pacman/bazzite READMEs): control
  plane is the fixed UDP 9777; the data plane is a separate random port that usually
  needs no rule, with the fixed-port option for strict firewalls.

Unit-tested: default random+hole-punch, and fixed-port-then-fallback-when-busy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/debian/README.md

@@ -55,8 +55,16 @@ journalctl --user -u punktfunk-web-init | sed -n 's/.*password generated: //p'
 Open the ports the host listens on. The **native `punktfunk/1`** plane:
 
 - **QUIC control plane: UDP 9777** (`serve --native-port N` to change).
-- **Data plane: an *ephemeral* UDP port** — negotiated per session, so there is no fixed port to
-  open. For a restrictive firewall you'd need to allow a UDP range (the repo does not pin one).
+- **Data plane: a separate UDP port.** By default it's *random* — the host binds `0.0.0.0:0` and
+  tells the client which port it got. Video flows host → client, but the **client sends the first
+  packet** (a hole-punch), so the host learns the client's real source and streams back — this
+  traverses NAT / inter-VLAN with no forwarded port. **You normally don't open it:** if a deny-inbound
+  firewall drops the punch, the host waits ~2.5 s and falls back to the client-reported address, and a
+  stateful firewall then admits the return (it just adds ~2.5 s to session start). To skip that delay,
+  pin it with **`serve --data-port <PORT>`** (or `PUNKTFUNK_DATA_PORT`): the host binds that fixed
+  port and streams direct (no punch-wait) — open exactly that one port. A fixed port serves one
+  session at a time (concurrent ones fall back to random + hole-punch), and direct mode needs the
+  client's reported address to be reachable (flat LAN / a non-remapping port-forward).
 
 And the **GameStream / Moonlight** ports (fixed) — only needed if you run the host with
 `serve --gamestream` (opt-in, trusted LAN only); bare `serve` is native-only and doesn't open these:
@@ -79,7 +87,9 @@ sudo ufw allow 9777/udp                                 # punktfunk/1 control pl
 sudo ufw allow 47984/tcp && sudo ufw allow 47989/tcp && sudo ufw allow 48010/tcp
 sudo ufw allow 47998:48010/udp
 sudo ufw allow 5353/udp
-# plus the ephemeral punktfunk/1 data port — open a UDP range you reserve for it.
+# The punktfunk/1 data plane uses a random UDP port; leave it closed on a LAN — the host hole-punches
+# and falls back (~2.5s at session start if firewalled). To skip that, pin it: `serve --data-port
+# 9778` and `ufw allow 9778/udp`.
 ```
 
 With raw `nftables` (add to your `inet filter input` chain):
@@ -88,7 +98,8 @@ With raw `nftables` (add to your `inet filter input` chain):
 udp dport 9777 accept                  # punktfunk/1 control plane
 tcp dport { 47984, 47989, 48010 } accept
 udp dport { 47998-48010, 5353 } accept
-# plus the ephemeral punktfunk/1 data port (a reserved UDP range).
+# The punktfunk/1 data plane is a random UDP port — normally left closed (hole-punch + ~2.5s
+# fallback). Pin it with `serve --data-port <PORT>` to open exactly one instead.
 ```
 
 ## Updates