compat: SemVer version windows between app and server

Both sides now declare what they will talk to, and enforce it. Two axes kept
deliberately separate, because conflating them is the trap:

  protocol_version  — CAN these builds talk. The correctness axis. Below 1.0.0
                      the minor is the breaking axis, per SemVer §4.
  release window    — MAY they, per policy. [min, max), advertised in the
                      profile, overridable by the operator.

The server refuses out-of-window apps with 426 and a body naming both versions
and the accepted range; the app checks the profile in both directions before a
run rather than discovering mid-measurement that it will be refused.

Three rules that shape the rest:

  - GET /v1/profile is never gated. It is where a refused client learns which
    version it needs; gating it leaves the user with a network error instead of
    an answer, which is precisely the confusion this exists to remove.
  - An unparseable or absent version is "unknown", and is allowed. Development
    builds report "dev", and a client too old to send the header cannot be
    identified anyway.
  - Bounds sit at breaking boundaries, not at releases, so shipping a patch
    never requires editing a range. The app's server minimum is 0.4.2 for a
    stated reason: earlier multi-homed servers mis-addressed granted sends and
    the client measured 100% downstream loss that never happened.

The app's versionCode is now derived from its SemVer instead of being a second
number someone has to remember to bump.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/internal/dataplane/udp.go

@@ -177,13 +177,14 @@ func (s *Server) mtuAck(conn *net.UDPConn, raddr netip.AddrPort, sess *session.S
 }
 
 // Observation block (spec §3.3), fixed 40 bytes appended to the RESP header:
-//   0  8  t_rx_ns (server clock, process epoch)
-//   8  8  t_tx_ns
-//  16 16  observed source IP (v4-mapped when v4)
-//  32  2  observed source port
-//  34  1  received TTL   (0xFF = not observed yet; needs recvmsg cmsgs)
-//  35  1  received DSCP/ECN byte (0xFF = not observed)
-//  36  4  received size
+//
+//	 0  8  t_rx_ns (server clock, process epoch)
+//	 8  8  t_tx_ns
+//	16 16  observed source IP (v4-mapped when v4)
+//	32  2  observed source port
+//	34  1  received TTL   (0xFF = not observed yet; needs recvmsg cmsgs)
+//	35  1  received DSCP/ECN byte (0xFF = not observed)
+//	36  4  received size
 func observation(tRxNs, tTxNs int64, src netip.AddrPort, rcvd int) []byte {
 	b := make([]byte, 40)
 	binary.BigEndian.PutUint64(b[0:8], uint64(tRxNs))