[2/4] Rebuild the transport core behind a backend seam

[SendableMetatype]

Stacked on #7. This branch contains its 3 commits; review the 3 commits after f10df32. As lower PRs merge I will rebase, so the diff collapses to this layer only.

The server data plane no longer reaches into libwebrtc. A WebRtcServerBackend interface owns offer negotiation and data channel transfer, with LibWebRtcServerBackend as the single class touching engine types: factory pooling, port allocator defaults, session tracking, and a lifecycle lock that makes close idempotent and safe against in flight accepts. NetherNet's countdown framing moves out of the channels into NetherNetFramingCodec, a standalone duplex handler covered by unit tests, fragmenting to the peer's advertised a=max-message-size, reassembling with a 16MB cap, and releasing partial reassembly buffers on teardown.

The performance and correctness work, all expressed against the seam:

• Connection setup runs off the signaling thread, whose keepalives must never starve behind blocking native calls.
• Optional PeerConnectionFactory pooling spreads DTLS and SCTP load across several native network threads.
• The data path caches open state instead of a JNI call per write, sends through the engine's async path, which copies before returning so buffers never escape, and delivers inbound with a single copy. Watermark backpressure pauses writes at 2MB of engine backlog, resumes at 512KB, and closes deterministically once pending writes exceed 8MB.
• Child channels expose the peer's real transport address from the ICE selected candidate pair. Remote candidates buffer until the remote description is applied. Client handshake retries are attempt scoped so stale engine callbacks cannot mutate a replacement attempt. Channel activation is guarded and single fire, hopping to the event loop when engine callbacks race it.
• Rebased on master after Add identity to SDP response #12: the answer path keeps the server identity assertion, now attached in the channel's session bridge, where a signing failure logs and sends the answer undecorated instead of throwing through the engine callback that delivered it (which also skipped surfacing the accepted child).

One deliberate tradeoff to flag for your judgment: child channels previously all shared new InetSocketAddress(0), which is clearly recognizable as not a real address but breaks anything keyed on the remote address (per IP connection limits treat every NetherNet player as one host). Each connection now gets a unique random 10.x.x.x placeholder, which keeps address keyed logic functional but is less obviously fictional in logs. With the candidate pair callback the placeholder only covers the window before ICE nomination and the rare case where the callback never fires, so if you prefer the recognizable 0.0.0.0 or another marker there, I am happy to adjust.

The backend uses RTCDataChannel.sendAsync and PeerConnectionObserver.onSelectedCandidatePairChanged from Kas-tle/webrtc-java#3, so this compiles once a webrtc-java release contains that change; no dependency pin or repository changes are included. Suggested review order: the three backend interfaces, the framing codec and its tests, LibWebRtcServerBackend, then the channel rewiring.

This transport has run in production through Geyser for about a month, on servers with 30+ concurrent players: signaling drop recovery without player disconnects, sustained throughput, and correct remote addresses are all live confirmed. The two smallest commits, the send teardown race and the session lifecycle hardening, are recent, from a pre submission review of that production code.