server: upstream trains, observed TTL/DSCP/ECN, rate limits, action ids

Types 0x03/0x04/0x05 land with a bounded columnar train buffer (head kept,
truncation declared) and grant-free multi-part reports - a report row is
smaller than the packet it answers, so $3.4 holds without a grant. The
read loop now collects TTL/TOS cmsgs on Linux, replacing the 0xFF stubs in
the observation block with what the kernel saw; downtrain gained a dscp
parameter, so DSCP survival is measurable in both directions.

Rate limiting ($2.5) exists now: per-credential AND per-source buckets,
429 on the control plane, silent drop on the data plane after the HMAC
gate and before the replay window. UDP ceilings default above the largest
legitimate run - a limit that clips a real measurement produces a
confidently wrong number.

Every granted packet carries its action_id at payload[8:16]; overlapping
actions were unattributable before. Canary DNS logs now honor the stated
24h privacy default. /admin/enroll-tokens answers the spec's JSON shape.
protocol_version 1.0.1 (additive).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/internal/dataplane/throughput.go

@@ -120,7 +120,7 @@ func (s *Server) DownThroughput(
 
 	// Same plan the grant was sized from, so the two cannot disagree.
 	durationMs, kbps = ThroughputPlan(durationMs, kbps)
-	if sizeBytes < HeaderSize+16 {
+	if sizeBytes < HeaderSize+24 {
 		sizeBytes = 1200 // a size that survives every common path unfragmented
 	}
 	if sizeBytes > 1472 {
@@ -134,6 +134,10 @@ func (s *Server) DownThroughput(
 	}
 
 	payload := make([]byte, sizeBytes-HeaderSize)
+	// [8:16]: the action id, as on every granted packet (spec §5 correlation). The send
+	// timestamp lives past it at [16:24]; the client reads only header fields today, so
+	// reserving the slot costs nothing and keeps one layout rule across granted types.
+	putActionID(payload, g.ActionID)
 	deadline := time.Now().Add(time.Duration(durationMs) * time.Millisecond)
 	start := time.Now()
 	next := start
@@ -157,7 +161,7 @@ func (s *Server) DownThroughput(
 		// Reaching here means the run is progressing normally; the clock will end it.
 		res.LimitedBy = "duration"
 		binary.BigEndian.PutUint32(payload[0:4], seq)
-		binary.BigEndian.PutUint64(payload[4:12], uint64(time.Since(s.start).Nanoseconds()))
+		binary.BigEndian.PutUint64(payload[16:24], uint64(time.Since(s.start).Nanoseconds()))
 		if err := s.sendErr(conn, target, sess, TypeThroughputData, seq, payload); err != nil {
 			// A send error mid-run is a local condition (buffer full, route gone). Stop and
 			// report what got out rather than pretending the rest was lost on the path.