feat(recovery): clean mid-stream loss recovery — freeze-until-reanchor + AMD LTR-RFI

Removes the "gray frames with motion" artifact on Vulkan-Video clients and lets
AMD/NVENC hosts re-anchor after loss WITHOUT a 20-40x IDR spike.

Client (pf-client-core): after a reference loss the hardware decoder conceals the
missing-reference deltas (on RADV, a gray plate with new motion painted over) and
returns Ok. The pump now freezes on the last good picture until a clean re-anchor
instead of showing the concealment — lifting on a real IDR, an intra-refresh
recovery mark (2nd wave boundary), or an LTR-RFI recovery anchor (1st). The
frame_index gap is the early, precise loss signal and drives an RFI request.

Host recovery signals (inert unless the backend supports them):
- USER_FLAG_RECOVERY_POINT — intra-refresh wave boundary (NVENC constrained GDR).
- USER_FLAG_RECOVERY_ANCHOR — AMD LTR reference-frame-invalidation recovery frame.

AMD LTR-RFI (encode/windows/amf.rs) — the AMD twin of NVENC RFI. AMF's AVC/HEVC API
has no constrained-intra property (intra-refresh cannot heal; PSNR-proven), so the
only clean-recovery lever is user LTR: mark frames as long-term references, and on
loss force the next frame to re-reference the newest known-good one — a clean
P-frame, not an IDR. Two rotating LTR slots, ~0.5s mark cadence, on by default for
AVC/HEVC (PUNKTFUNK_NO_AMF_LTR disables). invalidate_ref_frames picks the newest LTR
before the loss; a range older than the live slots falls back to a keyframe.

Protocol (punktfunk-core): RfiRequest control message + NativeClient::request_rfi().
Host: RfiRequest dispatch -> invalidate_ref_frames (IDR fallback); an RFI success
anchors the keyframe cooldown so the client's frames_dropped echo of the same loss
is coalesced away rather than emitting a redundant IDR.

Spike: synthetic NV12 GPU source for headless AMF encoder testing.

Validated: core rfi_request_roundtrip; pf-client-core 31 unit tests
(incl. an_rfi_anchor_lifts_immediately); punktfunk-host builds + 271 tests on Linux;
punktfunk-host builds clean on Windows; real AMD iGPU spike (invalidate at frame 90
forced re-reference to LTR frame 60 — 180 frames, keyframes=1, no recovery IDR).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

include/punktfunk_core.h

@@ -255,6 +255,25 @@
 // feeding them to the decoder. Punktfunk/1 only (GameStream never sets it).
 #define FLAG_PROBE 8
 
+// Application `user_flags` bit (the u32 [`PacketHeader::user_flags`] word, surfaced to the client
+// as [`crate::session::Frame::flags`]) — NOT a transport packet flag. Marks the access unit that
+// **completes an intra-refresh wave**: the picture is loss-free from here even though the frame is
+// a coded `P` (no IDR, so the decoder never sets `AV_FRAME_FLAG_KEY`). The client lifts its
+// post-loss display freeze on this bit as well as on a real keyframe — the only bitstream-invisible
+// clean point it can honor without forcing a full IDR. Lives above the low nibble because the host
+// reuses `FLAG_PIC`/`FLAG_SOF`/`FLAG_PROBE` bit values inside `user_flags`; `0x10` clears all four.
+#define USER_FLAG_RECOVERY_POINT 16
+
+// Application `user_flags` bit — a **definitive single-frame clean re-anchor**. Unlike
+// [`USER_FLAG_RECOVERY_POINT`] (an intra-refresh wave boundary, where the first boundary after a loss
+// is only half-healed so the client waits for the second), this marks an access unit the host coded
+// to reference a **known-good** picture on purpose — an AMD **LTR reference-frame-invalidation**
+// recovery frame (`ForceLTRReferenceBitfield`): a clean P-frame off a long-term reference the client
+// already has, not an IDR. The picture is loss-free the instant this AU decodes, so the client lifts
+// its post-loss freeze on the **first** such mark. Coded `P` (no IDR), so the decoder never sets
+// `AV_FRAME_FLAG_KEY` — this host flag is the only signal.
+#define USER_FLAG_RECOVERY_ANCHOR 32
+
 // Largest UDP datagram the core will send or accept. `Config::validate` bounds
 // `shard_payload` so `HEADER_LEN + shard_payload + CRYPTO_OVERHEAD ≤ MAX_DATAGRAM_BYTES`.
 #define MAX_DATAGRAM_BYTES 2048
@@ -462,6 +481,11 @@
 #define MSG_BITRATE_CHANGED 6
 #endif
 
+#if defined(PUNKTFUNK_FEATURE_QUIC)
+// Type byte of [`RfiRequest`].
+#define MSG_RFI_REQUEST 7
+#endif
+
 #if defined(PUNKTFUNK_FEATURE_QUIC)
 // Type byte of [`ProbeRequest`].
 #define MSG_PROBE_REQUEST 32