Cap header-obfuscation ingress de-mux CPU: source-endpoint fast path + per-drain full-scan budget

[Copilot]

With obfuscate=on (default), inbound peer selection trialed every configured peer's rx link key (one keyed-Blake2b each) per datagram before dropping unclaimed junk — an off-path attacker sending 36-byte spoofed UDP could amplify each packet into MAX_PEERS keyed hashes on the single-threaded reactor (~343 ns/peer, ~1000× the cleartext selector; #174). This implements mitigation options 1+2 from the issue, combined.

Changes

• Source-endpoint fast path (src/reactor.zig): selectIngressPeer now takes the datagram's UDP source and trials the peer whose current (learned) endpoint matches it first — address comparisons plus one keyed hash. All steady-state traffic, including previously-roamed peers, resolves in O(1).
• Metered fallback scan: only unknown-source datagrams (genuine roam/restart, or spoofed junk) fall back to the full-registry trial, capped at OBFS_SCAN_BUDGET = 8 scans per pumpUdpIngress drain (refilled per drain). Worst-case unauthenticated CPU is now 8 × MAX_PEERS keyed hashes per drain regardless of flood rate; junk past the budget costs only address comparisons. A roaming peer locked out by a concurrent flood retries next drain, wins a slot, authenticates, and its endpoint is learned back onto the fast path.
• Observability: new drop_udp_scan_budget counter in stats.Counters (auto-reflected into status JSON / Prometheus).
• Docs: docs/PROTOCOL.md §3.4 "Selection under obfuscation" and the §5 obfuscation note now specify the two-stage selection; tools/forward-bench.zig comments updated (its junk-sweep measurement is now the metered fallback's worst case, i.e. one budget slot).
• Tests: new reactor unit test covering the fast path (budget untouched), roaming fallback (one slot spent, endpoint learned), budget exhaustion under a junk burst (unknown_peer × 8 + scan_budget × overflow), and per-drain refill.

Iron-law compliant: zero allocation (one u32 of reactor state), single-threaded lock-free, no handshake. The AEAD gate is unchanged — selection remains a pre-filter hint only.