feat(core,host): per-family MTU shard sizing — the IPv6 gating item

Phase 1 of the dual-stack plan (design/client-parity-and-network-resilience.md, plan 5):
the host sizes each session's shard_payload from the QUIC remote's address family instead
of assuming IPv4 — 1408 over v4 (unchanged), 1388 over v6 (40-byte header). Rides the
existing Welcome::shard_payload negotiation, so there is zero wire change and old clients
simply follow.

This has to land before any v6 data path exists: the v4-maximal 1408 makes every sealed
video datagram overshoot a 1500-MTU IPv6 hop, and v6 routers never fragment — that's a
blackhole (every datagram dropped), not the graceful-ish degradation of the b5c30df v4
fragmentation saga. IPv4-mapped v6 remotes (::ffff:a.b.c.d, what a dual-stack [::] socket
reports for a v4 client) correctly keep the v4 size — they ride IPv4 on the wire.

New mtu1500_shard_payload_v6()/mtu1500_shard_payload_for() in core config with the same
pinned never-fragments/maximality tests as the v4 constant, plus a family-selection test.
Verified: 82 core lib tests + loopback/c_abi green and host check/clippy clean on Linux
(home-worker-2); core tests green on macOS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/punktfunk1.rs

@@ -27,7 +27,7 @@
 
 use anyhow::{anyhow, Context, Result};
 use punktfunk_core::config::{
-    mtu1500_shard_payload, CompositorPref, FecConfig, FecScheme, GamepadPref, Role,
+    mtu1500_shard_payload_for, CompositorPref, FecConfig, FecScheme, GamepadPref, Role,
 };
 use punktfunk_core::input::{InputEvent, InputKind};
 use punktfunk_core::packet::{FLAG_PIC, FLAG_PROBE, FLAG_SOF};
@@ -977,13 +977,16 @@ async fn serve_session(
                 max_data_per_block: 4096,
             },
             // The largest even payload whose sealed datagram (header + shard + crypto) fits an
-            // unfragmented IPv4/UDP packet on a 1500 MTU — 1408, giving 1472 = the exact ceiling.
-            // The previous 1452 overshot it (its math forgot the header/crypto ride inside the UDP
-            // payload) and silently IP-fragmented EVERY video datagram, doubling per-datagram loss
-            // on Wi-Fi — the "100 Mbps badly fails on the phone" root cause. Negotiated, so the
-            // client follows. Jumbo (≈8900) is a future negotiated bump (needs MAX_DATAGRAM_BYTES
-            // raised + end-to-end 9000 MTU).
-            shard_payload: mtu1500_shard_payload() as u16,
+            // unfragmented UDP packet on a 1500 MTU for THIS client's address family — 1408 over
+            // IPv4 (1472 = the exact ceiling), 1388 over IPv6 (40-byte header, and v6 routers
+            // don't fragment: overshooting there blackholes instead of degrading). The data plane
+            // dials the same family as this QUIC connection, so the remote decides. The previous
+            // hardcoded 1452 overshot the v4 ceiling (its math forgot the header/crypto ride
+            // inside the UDP payload) and silently IP-fragmented EVERY video datagram, doubling
+            // per-datagram loss on Wi-Fi — the "100 Mbps badly fails on the phone" root cause.
+            // Negotiated, so the client follows. Jumbo (≈8900) is a future negotiated bump (needs
+            // MAX_DATAGRAM_BYTES raised + end-to-end 9000 MTU).
+            shard_payload: mtu1500_shard_payload_for(peer.ip()) as u16,
             encrypt: true,
             key,
             salt: *b"pkf1",