fix(core,android): networking-audit small follow-ups — bounds, oversized AUs, probe flag

Networking-audit deferred plan §6:

- 6.1 client reassembler ceiling derived from the negotiated rate:
  Welcome::session_config (client role) now sets max_frame_bytes to
  clamp(4 × bitrate_kbps×125 / refresh_hz, 8 MiB, 64 MiB) instead of the
  blanket 64 MiB p1_defaults bound — the hostile-header memory ceiling was
  ~10× larger than any real access unit. Local only (the host never
  reassembles video; the wire is self-describing); a bitrate-0 (older)
  host keeps the old bound. Unit-tested floor/derived/host/old-host cases.
- 6.2 ProbeState.active is cleared when the host's ProbeResult lands, so
  the pump stops mirroring receive counters once the burst is over.
- 6.3 Android: an AU larger than the codec input buffer is DROPPED with a
  recovery-keyframe request and a counter, on both the sync (feed) and
  async (feed_ready) paths — a truncated AU is corrupt input the decoder
  chews on silently, poisoning the reference chain until the next IDR. The
  async path recycles the never-queued input slot; the sync path returns
  the dequeued slot with zero valid bytes.
- 6.4 bounded uplink channels: mic_tx at 64 (~320 ms of 5 ms frames;
  overflow sheds the fresh frame with a debug log — a tokio mpsc can't
  shed from the head, and past 320 ms of backlog the mic is broken either
  way; the bound is about memory) and ctrl_tx at 32 (sparse requests; a
  full queue means a wedged control task, reported as Closed). input_tx
  stays unbounded per the plan: keyboard/mouse events must never silently
  drop, and gamepad state is snapshot-healed.
- 6.5 (wire version byte says P1 while streaming Gf16): record-only,
  resolves with the P2 packet revision.

include/punktfunk_core.h: cbindgen re-emitted in the new module order
after the quic/ split (item 3) — no semantic change beyond the reorder.

cargo ndk check (arm64-v8a), workspace clippy, core+host tests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

include/punktfunk_core.h

@@ -250,6 +250,58 @@
 // `shard_payload` so `HEADER_LEN + shard_payload + CRYPTO_OVERHEAD ≤ MAX_DATAGRAM_BYTES`.
 #define MAX_DATAGRAM_BYTES 2048
 
+#if defined(PUNKTFUNK_FEATURE_QUIC)
+// Rounds per batch — matches the connect-time [`clock_sync`].
+#define ClockResync_ROUNDS 8
+#endif
+
+#if defined(PUNKTFUNK_FEATURE_QUIC)
+// Datagram wire tags. Video rides UDP; everything low-rate rides QUIC datagrams,
+// demultiplexed by the first byte: input = [`crate::input::INPUT_MAGIC`] (0xC8, client→host),
+// audio = [`AUDIO_MAGIC`] (0xC9, host→client), rumble = [`RUMBLE_MAGIC`] (0xCA, host→client),
+// mic = [`MIC_MAGIC`] (0xCB, client→host), rich-input = [`RICH_INPUT_MAGIC`] (0xCC, client→host),
+// HID-output = [`HIDOUT_MAGIC`] (0xCD, host→client), HDR metadata = [`HDR_META_MAGIC`]
+// (0xCE, host→client).
+#define PUNKTFUNK_AUDIO_MAGIC 201
+#endif
+
+#if defined(PUNKTFUNK_FEATURE_QUIC)
+#define PUNKTFUNK_RUMBLE_MAGIC 202
+#endif
+
+#if defined(PUNKTFUNK_FEATURE_QUIC)
+// Microphone uplink: the client's mic, Opus-encoded, client → host (the inverse of
+// [`AUDIO_MAGIC`]). The host feeds it into a virtual PipeWire source so its apps can record it.
+#define MIC_MAGIC 203
+#endif
+
+#if defined(PUNKTFUNK_FEATURE_QUIC)
+// Rich client→host input: events too big for the fixed 18-byte [`InputEvent`]
+// (crate::input::InputEvent) — the DualSense touchpad and motion sensors. Variable-length,
+// kind-tagged (see [`RichInput`]).
+#define RICH_INPUT_MAGIC 204
+#endif
+
+#if defined(PUNKTFUNK_FEATURE_QUIC)
+// HID output, host → client: DualSense feedback a game wrote to the host's virtual controller
+// (lightbar, player LEDs, adaptive triggers) — the rich analog of [`RUMBLE_MAGIC`]. See
+// [`HidOutput`].
+#define HIDOUT_MAGIC 205
+#endif
+
+#if defined(PUNKTFUNK_FEATURE_QUIC)
+// HDR static-metadata datagram tag, host → client (the static analog of the per-frame VUI;
+// see [`HdrMeta`]). Next tag after [`HIDOUT_MAGIC`].
+#define HDR_META_MAGIC 206
+#endif
+
+#if defined(PUNKTFUNK_FEATURE_QUIC)
+// Per-AU host-timing datagram tag, host → client (see [`HostTiming`]). Next tag after
+// [`HDR_META_MAGIC`]. Emitted once per access unit, right after its last packet left the host's
+// socket, and only when the client advertised [`VIDEO_CAP_HOST_TIMING`].
+#define HOST_TIMING_MAGIC 207
+#endif
+
 #if defined(PUNKTFUNK_FEATURE_QUIC)
 // [`Hello::video_caps`] bit: the client can decode a 10-bit (Main10) HEVC stream.
 #define VIDEO_CAP_10BIT 1
@@ -419,53 +471,6 @@
 #define MSG_PAIR_RESULT 19
 #endif
 
-#if defined(PUNKTFUNK_FEATURE_QUIC)
-// Datagram wire tags. Video rides UDP; everything low-rate rides QUIC datagrams,
-// demultiplexed by the first byte: input = [`crate::input::INPUT_MAGIC`] (0xC8, client→host),
-// audio = [`AUDIO_MAGIC`] (0xC9, host→client), rumble = [`RUMBLE_MAGIC`] (0xCA, host→client),
-// mic = [`MIC_MAGIC`] (0xCB, client→host), rich-input = [`RICH_INPUT_MAGIC`] (0xCC, client→host),
-// HID-output = [`HIDOUT_MAGIC`] (0xCD, host→client), HDR metadata = [`HDR_META_MAGIC`]
-// (0xCE, host→client).
-#define PUNKTFUNK_AUDIO_MAGIC 201
-#endif
-
-#if defined(PUNKTFUNK_FEATURE_QUIC)
-#define PUNKTFUNK_RUMBLE_MAGIC 202
-#endif
-
-#if defined(PUNKTFUNK_FEATURE_QUIC)
-// Microphone uplink: the client's mic, Opus-encoded, client → host (the inverse of
-// [`AUDIO_MAGIC`]). The host feeds it into a virtual PipeWire source so its apps can record it.
-#define MIC_MAGIC 203
-#endif
-
-#if defined(PUNKTFUNK_FEATURE_QUIC)
-// Rich client→host input: events too big for the fixed 18-byte [`InputEvent`]
-// (crate::input::InputEvent) — the DualSense touchpad and motion sensors. Variable-length,
-// kind-tagged (see [`RichInput`]).
-#define RICH_INPUT_MAGIC 204
-#endif
-
-#if defined(PUNKTFUNK_FEATURE_QUIC)
-// HID output, host → client: DualSense feedback a game wrote to the host's virtual controller
-// (lightbar, player LEDs, adaptive triggers) — the rich analog of [`RUMBLE_MAGIC`]. See
-// [`HidOutput`].
-#define HIDOUT_MAGIC 205
-#endif
-
-#if defined(PUNKTFUNK_FEATURE_QUIC)
-// HDR static-metadata datagram tag, host → client (the static analog of the per-frame VUI;
-// see [`HdrMeta`]). Next tag after [`HIDOUT_MAGIC`].
-#define HDR_META_MAGIC 206
-#endif
-
-#if defined(PUNKTFUNK_FEATURE_QUIC)
-// Per-AU host-timing datagram tag, host → client (see [`HostTiming`]). Next tag after
-// [`HDR_META_MAGIC`]. Emitted once per access unit, right after its last packet left the host's
-// socket, and only when the client advertised [`VIDEO_CAP_HOST_TIMING`].
-#define HOST_TIMING_MAGIC 207
-#endif
-
 #if defined(PUNKTFUNK_FEATURE_QUIC)
 // CICP colour-primaries code point: BT.709.
 #define ColorInfo_CP_BT709 1
@@ -502,11 +507,6 @@
 #define ColorInfo_MC_BT2020_NCL 9
 #endif
 
-#if defined(PUNKTFUNK_FEATURE_QUIC)
-// Rounds per batch — matches the connect-time [`clock_sync`].
-#define ClockResync_ROUNDS 8
-#endif
-
 // Stable C ABI status codes. `Ok` is 0; all errors are negative so callers can
 // test `rc < 0`. Do not renumber existing variants — only append.
 enum PunktfunkStatus