server: self-test — sysctl audit + egress-MTU self-proof ("server proven good")

A measurement server must prove its own host isn't distorting results:
- sysctl audit (/proc/sys): flags accept_ra on a static host, ICMP
  redirects, ICMP rate-limiting of the server's own errors, and disabled
  TCP options — each a measurement-fidelity hazard, with the "why".
- egress-MTU self-proof: DF PMTUD probe (IP_MTU_DISCOVER + getsockopt
  IP_MTU, no root — Linux-only, stub elsewhere) to external anchors. If the
  server's own uplink is below 1500, client MTU tests measure THIS server,
  so we say so.
Exposed at GET /admin/selftest (full report) and as server_selftest
{mtu_ok, sysctl_ok} in the profile so clients can trust or skip MTU tests.
Recommended deploy/99-echolot-sysctl.conf + README section.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/deploy/99-echolot-sysctl.conf

@@ -0,0 +1,40 @@
+# SPDX-FileCopyrightText: 2026 Echolot contributors
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# Recommended sysctls for an Echolot probe-server host: keep the kernel from
+# silently altering what clients measure. Install with:
+#   sudo cp 99-echolot-sysctl.conf /etc/sysctl.d/
+#   sudo sysctl --system
+# The daemon audits these at startup and via GET /admin/selftest; anything not
+# set here shows up as a "not measurement-clean" warning.
+
+# Static-addressed host: never let a Router Advertisement mutate our routing.
+# (Echolot's whole job is detecting broken RAs — the server must be immune.)
+net.ipv6.conf.all.accept_ra = 0
+net.ipv6.conf.default.accept_ra = 0
+
+# Don't let ICMP redirects rewrite our routing mid-measurement, and don't
+# emit redirects (we're an endpoint, not a router).
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.default.accept_redirects = 0
+net.ipv6.conf.all.accept_redirects = 0
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+
+# Don't throttle the server's own ICMP errors (dest-unreachable/frag-needed/
+# time-exceeded) — throttling produces false loss/black-hole readings when
+# clients probe toward this server.
+net.ipv4.icmp_ratelimit = 0
+
+# These are usually already correct; pinned so the server can honestly
+# negotiate/reflect them (a missing option in a client's evidence is then the
+# path's fault, not ours).
+net.ipv4.tcp_sack = 1
+net.ipv4.tcp_timestamps = 1
+net.ipv4.tcp_window_scaling = 1
+net.ipv4.ip_no_pmtu_disc = 0
+net.ipv4.icmp_echo_ignore_all = 0
+
+# Loose reverse-path filtering suits a multi-IP measurement host (strict mode
+# can drop alt-address / asymmetric replies used by STUN 5780).
+net.ipv4.conf.all.rp_filter = 2