fix(core,android): networking-audit small follow-ups — bounds, oversized AUs, probe flag

Networking-audit deferred plan §6:

- 6.1 client reassembler ceiling derived from the negotiated rate:
  Welcome::session_config (client role) now sets max_frame_bytes to
  clamp(4 × bitrate_kbps×125 / refresh_hz, 8 MiB, 64 MiB) instead of the
  blanket 64 MiB p1_defaults bound — the hostile-header memory ceiling was
  ~10× larger than any real access unit. Local only (the host never
  reassembles video; the wire is self-describing); a bitrate-0 (older)
  host keeps the old bound. Unit-tested floor/derived/host/old-host cases.
- 6.2 ProbeState.active is cleared when the host's ProbeResult lands, so
  the pump stops mirroring receive counters once the burst is over.
- 6.3 Android: an AU larger than the codec input buffer is DROPPED with a
  recovery-keyframe request and a counter, on both the sync (feed) and
  async (feed_ready) paths — a truncated AU is corrupt input the decoder
  chews on silently, poisoning the reference chain until the next IDR. The
  async path recycles the never-queued input slot; the sync path returns
  the dequeued slot with zero valid bytes.
- 6.4 bounded uplink channels: mic_tx at 64 (~320 ms of 5 ms frames;
  overflow sheds the fresh frame with a debug log — a tokio mpsc can't
  shed from the head, and past 320 ms of backlog the mic is broken either
  way; the bound is about memory) and ctrl_tx at 32 (sparse requests; a
  full queue means a wedged control task, reported as Closed). input_tx
  stays unbounded per the plan: keyboard/mouse events must never silently
  drop, and gamepad state is snapshot-healed.
- 6.5 (wire version byte says P1 while streaming Gf16): record-only,
  resolves with the P2 packet revision.

include/punktfunk_core.h: cbindgen re-emitted in the new module order
after the quic/ split (item 3) — no semantic change beyond the reorder.

cargo ndk check (arm64-v8a), workspace clippy, core+host tests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-core/src/quic/msgs.rs

@@ -902,6 +902,17 @@ impl Welcome {
         c.encrypt = self.encrypt;
         c.key = self.key;
         c.salt = self.salt;
+        // Client-side reassembler ceiling: p1_defaults' 64 MiB hostile-header memory bound is
+        // ~10x larger than any real access unit. Derive it from the negotiated rate instead:
+        // 4x the average frame size at the resolved bitrate (IDR headroom), floored at 8 MiB,
+        // capped at the old 64 MiB. Purely local — the host never reassembles video and the
+        // wire is self-describing, so old hosts are unaffected; a host that reports bitrate 0
+        // (pre-negotiation) keeps the old bound.
+        if role == Role::Client && self.bitrate_kbps > 0 {
+            let per_frame = (self.bitrate_kbps as usize).saturating_mul(125)
+                / self.mode.refresh_hz.max(1) as usize;
+            c.max_frame_bytes = per_frame.saturating_mul(4).clamp(8 << 20, 64 << 20);
+        }
         c
     }
 }