feat: SDWAN data plane + UDP punch port fix + TUN reader

SDWAN:
- protocol: add SDWANConfig/SDWANPeer/SDWANPacket structs, MsgTunnel type
- server: sdwan.go (JSON file store), sdwan_api.go (Get/Set/broadcast/route)
- server: push SDWAN config on login, announce peer online/offline events
- server: RouteSDWANPacket routes TUN packets between nodes via signaling
- client: TUN device setup (optun), tunReadLoop reads IP packets
- client: handle SDWANConfig/SDWANPeer/SDWANDel push messages
- client: apply routes (per-node /32 + broad CIDR fallback)

UDP punch fix:
- nat/detect: capture LocalPort from STUN UDP socket for punch binding
- client: pass publicPort + localPort through login and punch config
- coordinator: include PublicPort in PunchParams for both sides
- protocol: add PublicPort to LoginReq and ReportBasic

Other:
- server: use client-reported PublicIP instead of raw r.RemoteAddr
- server: update PublicIP/Port from ReportBasic if provided
- client: config file loading with zero-value defaults backfill
- .gitignore: exclude run/, *.pid, *.log, sdwan.json
- go.mod: add golang.org/x/sys for TUN ioctl

pkg/nat/detect.go

@@ -16,10 +16,11 @@ const (
 
 // DetectResult holds the NAT detection outcome.
 type DetectResult struct {
-	Type     protocol.NATType
-	PublicIP string
-	Port1    int // external port seen on STUN server port 1
-	Port2    int // external port seen on STUN server port 2
+	Type      protocol.NATType
+	PublicIP  string
+	Port1     int // external port seen on STUN server port 1
+	Port2     int // external port seen on STUN server port 2
+	LocalPort int // local UDP port used for detection (for punch bind)
 }
 
 // stunReq is sent to the STUN endpoint.
@@ -45,6 +46,9 @@ func DetectUDP(serverIP string, port1, port2 int) DetectResult {
 		return result
 	}
 	defer conn.Close()
+	if ua, ok := conn.LocalAddr().(*net.UDPAddr); ok {
+		result.LocalPort = ua.Port
+	}
 
 	r1, err1 := probeUDP(conn, serverIP, port1, 1)
 	r2, err2 := probeUDP(conn, serverIP, port2, 2)