server: §3.4 asymmetric grants + downtrain and big_send actions

The grant is the keystone that makes server->client sends safe: created
only by an authenticated control-plane action, bound at creation to the
session's OBSERVED data-plane source (so it can never be aimed at a third
party), and bounded by bytes, average rate and expiry. Sends stop the
moment the budget runs out, so a buggy action cannot become a flood.

Two granted actions on top of it:
- downtrain: N packets at a given size/interval toward the client, with
  seq + send-timestamp in the payload — downstream loss/reorder/jitter,
  which an upstream-only train cannot measure.
- big_send: one datagram per requested size, echoing the intended size in
  the payload — downstream MTU / black-hole evidence the client cannot
  produce for itself (only the far end can emit a large packet toward it).

Tests cover the security properties: no grant without a verified
destination, client requests clamped to server limits, byte budget stops
sending exactly, expiry refuses, and the rate ceiling throttles a burst.
Capabilities gain downtrain + big-send.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/internal/dataplane/udp.go

@@ -32,6 +32,9 @@ const (
 	TypeMtuProbe    = 0x09
 	TypeMtuAck      = 0x0A
 	TypeDelayedEcho = 0x0B
+	// Server->client under an asymmetric grant (spec §3.4/§5).
+	TypeDownTrainData = 0x06
+	TypeBigSend       = 0x0C
 )
 
 type Server struct {