Add STUN Binding over TCP

[ccding]

Summary

• add RFC 8489 basic STUN Binding transactions over TCP
• support both internally dialed connections and caller-owned persistent net.Conn values
• expose TCP transport through the CLI with -t tcp
• share Binding response validation across UDP and TCP
• document transport semantics, timeout behavior, and connection ownership
• add deterministic coverage for fragmented/coalesced frames, unrelated responses, server errors, timeouts, connection reuse, and connection cleanup

Why

Issue #49 asks for TCP support. STUN uses the same message format over TCP without an additional length prefix; TCP provides reliability, so the client sends one request and reads the 20-byte STUN header plus its declared body without STUN-layer retransmission. NAT behavior discovery stays UDP-only because its change-address probes do not apply to this basic TCP Binding path.

Validation

• go test ./...
• go test -race -shuffle=on -count=3 ./...
• go vet ./...
• staticcheck -checks=all ./...
• go test -cover ./stun (89.6% statement coverage)
• git diff --check

Closes #49

[ccding]

Review reconciliation:

• Codex final review: APPROVE, no actionable findings.
• Claude multi-agent review verified one timeout-contract documentation issue; it was fixed with explicit RFC 8489 response and dial semantics plus a regression assertion.
• Claude follow-up review caught the README transport-table delimiter; it was fixed.
• Final Claude verdict: APPROVE.
• All 12 required CI and security checks pass on b0a4ce7.