feat(punktfunk/1): cross-VLAN/NAT video via data-plane hole-punching

The video data plane is a raw UDP socket separate from the QUIC control connection. On a flat LAN
the host can send straight to the client, but across NAT or a stateful inter-VLAN firewall the
unsolicited host→client video is rejected (ICMP port-unreachable → the session dies immediately,
while control/audio/input keep working since they ride the client-initiated QUIC). Observed live:
a client on 192.168.6.2 streaming from a host on 192.168.1.48.

Fix: client-initiated hole-punching. The client sends PUNCH_MAGIC datagrams from its data socket
to the host's advertised data port (Welcome.udp_port); that opens the firewall/NAT return path and
lets the host learn the client's OBSERVED source (the NAT-translated address, not the client's
reported private one). The host (UdpTransport::connect_via_punch) waits ≤2.5s for the first punch
and streams there, falling back to the client-reported address for clients that don't punch
(flat-LAN behaviour unchanged). The client keeps a low-rate keepalive so a stateful firewall's idle
timeout can't close the path during a static, low-bitrate scene. Wired into client-rs and the
NativeClient connector (covers the Linux + Apple clients; the Apple app needs an xcframework rebuild
to pick up the new core).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-core/src/transport/mod.rs

@@ -5,7 +5,7 @@ mod loopback;
 mod udp;
 
 pub use loopback::{loopback_pair, LoopbackTransport};
-pub use udp::UdpTransport;
+pub use udp::{spawn_data_punch, UdpTransport, PUNCH_MAGIC};
 
 /// A datagram transport. `recv` is non-blocking: it returns `Ok(None)` when no packet
 /// is currently available, so the caller (decode/present thread) never blocks here.