feat(punktfunk/1): negotiable encoder bitrate + bandwidth speed-test probe

Two related additions to the native protocol, host-side (the client side of
each is exposed over the C ABI so the platform clients can wire it up).

Bitrate negotiation
- Hello/Welcome carry `bitrate_kbps` (appended trailing-byte field, back-compat:
  old peers decode 0 = host default). The client requests a rate; the host
  clamps it to [500 kbps, 500 Mbps] (or its 20 Mbps default when 0) and echoes
  the resolved value in Welcome. Replaces the hardcoded 20 Mbps NVENC bitrate in
  m3.rs — threaded through virtual_stream → build_pipeline → open_video, applied
  on the initial mode and every reconfigure rebuild.
- C ABI: punktfunk_connect_ex3(..., bitrate_kbps, ...) (ex2 delegates with 0);
  punktfunk_connection_bitrate() reads the resolved value.

Speed test (bandwidth probe)
- New typed control messages ProbeRequest{target_kbps,duration_ms} (0x20) /
  ProbeResult{bytes_sent,packets_sent,duration_ms} (0x21), plus a FLAG_PROBE
  packet flag. The client asks the host to burst zero-filled, FLAG_PROBE-tagged
  access units over the data plane at a target goodput for a duration (clamped
  ≤ 1 Gbps / ≤ 5 s), pacing by a bytes-allowed budget; video pauses for the
  burst. The host reports what it actually sent; the client measures received
  bytes + window → goodput and loss. Probe filler is never fed to the decoder
  (diverted in the connector pump and the reference client's poll loop).
- The host control task now multiplexes Reconfigure + ProbeRequest (inbound)
  and ProbeResult (outbound) over select!; a probe channel reaches the
  data-plane thread (both virtual and synthetic sources).
- Connector: NativeClient::request_probe()/probe_result() with an internal
  accumulator; C ABI punktfunk_connection_speed_test() +
  punktfunk_connection_probe_result() → PunktfunkProbeResult.
- punktfunk-client-rs gains `--bitrate KBPS` and `--speed-test KBPS:MS` (its own
  loop measures + logs goodput/loss) for loopback verification.

Validated on loopback (synthetic source): a 20 Mbps / 2 s probe measured
20050 kbps at 0% loss, bitrate negotiated (0→20000 and 50000→50000), and the
interleaved probe AUs were correctly excluded from frame verification
(mismatched=0). Wire codecs + trailing-byte back-compat have unit tests. C
header regenerated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-core/src/abi.rs

@@ -748,6 +748,50 @@ pub unsafe extern "C" fn punktfunk_connect_ex2(
     client_cert_pem: *const std::os::raw::c_char,
     client_key_pem: *const std::os::raw::c_char,
     timeout_ms: u32,
+) -> *mut PunktfunkConnection {
+    unsafe {
+        punktfunk_connect_ex3(
+            host,
+            port,
+            width,
+            height,
+            refresh_hz,
+            compositor,
+            gamepad,
+            0, // bitrate_kbps = 0: let the host pick its default
+            pin_sha256,
+            observed_sha256_out,
+            client_cert_pem,
+            client_key_pem,
+            timeout_ms,
+        )
+    }
+}
+
+/// Like [`punktfunk_connect_ex2`], but additionally requests the video encoder `bitrate_kbps`
+/// (kilobits per second). `0` lets the host pick its default; any other value is clamped to the
+/// host's supported range. After a speed test ([`punktfunk_connection_speed_test`]) a client can
+/// reconnect (or pick at connect time) with the measured rate. The value the host actually
+/// configured is readable via [`punktfunk_connection_bitrate`].
+///
+/// # Safety
+/// Same as [`punktfunk_connect`].
+#[cfg(feature = "quic")]
+#[no_mangle]
+pub unsafe extern "C" fn punktfunk_connect_ex3(
+    host: *const std::os::raw::c_char,
+    port: u16,
+    width: u32,
+    height: u32,
+    refresh_hz: u32,
+    compositor: u32,
+    gamepad: u32,
+    bitrate_kbps: u32,
+    pin_sha256: *const u8,
+    observed_sha256_out: *mut u8,
+    client_cert_pem: *const std::os::raw::c_char,
+    client_key_pem: *const std::os::raw::c_char,
+    timeout_ms: u32,
 ) -> *mut PunktfunkConnection {
     let r = std::panic::catch_unwind(AssertUnwindSafe(|| {
         if host.is_null() {
@@ -790,6 +834,7 @@ pub unsafe extern "C" fn punktfunk_connect_ex2(
             mode,
             pref,
             gamepad,
+            bitrate_kbps,
             pin,
             identity,
             std::time::Duration::from_millis(timeout_ms as u64),
@@ -1245,6 +1290,32 @@ pub unsafe extern "C" fn punktfunk_connection_gamepad(
     })
 }
 
+/// The video encoder bitrate (kilobits per second) the host actually configured for this session
+/// — the [`punktfunk_connect_ex3`] request clamped to the host's range, or its default when `0`
+/// was requested. `0` = an older host that didn't report it. Safe any time after connect.
+///
+/// # Safety
+/// `c` is a valid connection handle; `bitrate_kbps` is writable (NULL is skipped).
+#[cfg(feature = "quic")]
+#[no_mangle]
+pub unsafe extern "C" fn punktfunk_connection_bitrate(
+    c: *const PunktfunkConnection,
+    bitrate_kbps: *mut u32,
+) -> PunktfunkStatus {
+    guard(|| {
+        let c = match unsafe { c.as_ref() } {
+            Some(c) => c,
+            None => return PunktfunkStatus::NullPointer,
+        };
+        unsafe {
+            if !bitrate_kbps.is_null() {
+                *bitrate_kbps = c.inner.resolved_bitrate_kbps;
+            }
+        }
+        PunktfunkStatus::Ok
+    })
+}
+
 /// Ask the host to switch the live session to `width`x`height`@`refresh_hz` without
 /// reconnecting (window resized, refresh changed). Non-blocking enqueue: on acceptance the
 /// stream continues at the new mode — the first new-mode access unit is an IDR with
@@ -1278,6 +1349,91 @@ pub unsafe extern "C" fn punktfunk_connection_request_mode(
     })
 }
 
+/// A speed-test measurement, filled by [`punktfunk_connection_probe_result`]. `done` is 0 until
+/// the host's end-of-burst report lands, then 1 (the numbers are final). `throughput_kbps` is the
+/// measured goodput to drive a bitrate choice from; `loss_pct` is the delivery loss at that rate.
+#[repr(C)]
+#[derive(Clone, Copy, Debug, Default)]
+pub struct PunktfunkProbeResult {
+    /// 1 once the host's end-of-burst report arrived (measurement final); else 0 (partial).
+    pub done: u8,
+    /// Probe payload bytes / packets the client received.
+    pub recv_bytes: u64,
+    pub recv_packets: u32,
+    /// Probe payload bytes / packets the host reported sending.
+    pub host_bytes: u64,
+    pub host_packets: u32,
+    /// Client-measured receive window (first→last probe AU), milliseconds.
+    pub elapsed_ms: u32,
+    /// Measured goodput = `recv_bytes * 8 / elapsed_ms` (kilobits/second).
+    pub throughput_kbps: u32,
+    /// Delivery loss `(host_bytes - recv_bytes) / host_bytes` as a percentage (0 if unknown).
+    pub loss_pct: f32,
+}
+
+/// Start a bandwidth speed test: ask the host to burst filler over the data plane at
+/// `target_kbps` of goodput for `duration_ms` (each clamped host-side to ≤ 1 Gbps / ≤ 5 s),
+/// *briefly pausing video*. Non-blocking — poll [`punktfunk_connection_probe_result`] until its
+/// `done` field is 1. Starting a probe resets any prior measurement.
+///
+/// # Safety
+/// `c` is a valid connection handle.
+#[cfg(feature = "quic")]
+#[no_mangle]
+pub unsafe extern "C" fn punktfunk_connection_speed_test(
+    c: *const PunktfunkConnection,
+    target_kbps: u32,
+    duration_ms: u32,
+) -> PunktfunkStatus {
+    guard(|| {
+        let c = match unsafe { c.as_ref() } {
+            Some(c) => c,
+            None => return PunktfunkStatus::NullPointer,
+        };
+        match c.inner.request_probe(target_kbps, duration_ms) {
+            Ok(()) => PunktfunkStatus::Ok,
+            Err(e) => e.status(),
+        }
+    })
+}
+
+/// Read the current speed-test measurement into `*out` (partial until `out->done == 1`). Safe to
+/// poll repeatedly after [`punktfunk_connection_speed_test`]; before any probe it reports zeros.
+///
+/// # Safety
+/// `c` is a valid connection handle; `out` is writable for one `PunktfunkProbeResult` (NULL is an
+/// error).
+#[cfg(feature = "quic")]
+#[no_mangle]
+pub unsafe extern "C" fn punktfunk_connection_probe_result(
+    c: *const PunktfunkConnection,
+    out: *mut PunktfunkProbeResult,
+) -> PunktfunkStatus {
+    guard(|| {
+        let c = match unsafe { c.as_ref() } {
+            Some(c) => c,
+            None => return PunktfunkStatus::NullPointer,
+        };
+        if out.is_null() {
+            return PunktfunkStatus::NullPointer;
+        }
+        let o = c.inner.probe_result();
+        unsafe {
+            *out = PunktfunkProbeResult {
+                done: o.done as u8,
+                recv_bytes: o.recv_bytes,
+                recv_packets: o.recv_packets,
+                host_bytes: o.host_bytes,
+                host_packets: o.host_packets,
+                elapsed_ms: o.elapsed_ms,
+                throughput_kbps: o.throughput_kbps,
+                loss_pct: o.loss_pct,
+            };
+        }
+        PunktfunkStatus::Ok
+    })
+}
+
 /// Close the connection and free the handle (joins the internal threads). NULL is a no-op.
 ///
 /// # Safety