engine: downstream MTU and downstream train in the measurement document

Three facts the client cannot produce alone, kept deliberately separate:
mtu.pmtud_down (largest datagram that arrives unfragmented — meaningful only
because the server sets DF), mtu.frag_delivery (whether larger ones arrive once
fragmentation is allowed), and train.udp_downstream (loss, reordering and
arrival spacing in the download direction, which a round trip cannot separate
from upstream loss).

ServerMeasurement now runs them on the same ProbeSession as the echo train. It
had to: a fresh session restarts client-side sequence numbers and the server's
anti-replay window discards the lot, so the re-primed source is never recorded
and every granted send goes to a socket that has already closed. That produced
four confidently-wrong FAILED tests and a RED verdict on a healthy network.

Live against fmr: path MTU 1500, fragments to 4000, 100/100 downstream, GREEN.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/wrangler.jsonc

@@ -22,14 +22,14 @@
   // its route fall back to the homepage's install section, so nothing 404s
   // before the first release exists.
   "vars": {
-    // Gitea repo API base, e.g. "https://git.example.net/api/v1/repos/mram/echolot".
-    // The repo (or at least its releases) must be publicly readable.
-    "GITEA_REPO_API": "",
-    // Manual override / fallback while GITEA_REPO_API is unset or unreachable.
+    // Gitea repo API base. The repo (or at least its releases) must be
+    // publicly readable for /apk and /api/latest to resolve.
+    "GITEA_REPO_API": "https://git.rambossek.at/api/v1/repos/EchoLot/echolot",
+    // Manual override / fallback while GITEA_REPO_API is unreachable.
     "DOWNLOAD_URL": "",
     // F-Droid listing, once it exists: https://f-droid.org/packages/app.echo_lot.app/
     "FDROID_URL": "",
     // Public source URL, the footer + /source target.
-    "SOURCE_URL": ""
+    "SOURCE_URL": "https://git.rambossek.at/EchoLot/echolot"
   }
 }