server: MTU probe (MTU_PROBE/MTU_ACK) — path-MTU / black-hole measurement

Server ACKs each DF-flagged probe with a tiny MTU_ACK carrying the size it
received; the client binary-searches the path MTU. Non-amplifying by
construction. Tested.

Also records: v0.3.2 (http-echo + tls-reference) verified live on fmr, and
the finding that upstream trains are already observable via the
observations API (dedicated TRAIN_REPORT deferred — needs an
anti-amplification grant + columnar encoding).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/internal/dataplane/udp_test.go

@@ -102,6 +102,40 @@ func TestEchoRoundtripObservationAndAntiAmplification(t *testing.T) {
 	}
 }
 
+func TestMtuProbeAckReportsReceivedSizeAndDoesNotAmplify(t *testing.T) {
+	mgr, addr := startServer(t)
+	sess, _, err := mgr.New("dev1", "credential-ikm", netip.MustParseAddr("127.0.0.1"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	client, err := net.DialUDP("udp", nil, net.UDPAddrFromAddrPort(addr))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer client.Close()
+	client.SetDeadline(time.Now().Add(2 * time.Second))
+
+	// A large probe: 32 header + 1400 payload.
+	probe := craft(t, sess, TypeMtuProbe, 1, make([]byte, 1400))
+	if _, err := client.Write(probe); err != nil {
+		t.Fatal(err)
+	}
+	buf := make([]byte, 2000)
+	n, err := client.Read(buf)
+	if err != nil {
+		t.Fatalf("no MTU_ACK: %v", err)
+	}
+	if buf[4] != TypeMtuAck {
+		t.Fatalf("type = %#x, want MTU_ACK", buf[4])
+	}
+	if n >= len(probe) {
+		t.Fatalf("MTU_ACK (%d) must be far smaller than the probe (%d)", n, len(probe))
+	}
+	if got := binary.BigEndian.Uint32(buf[HeaderSize:n]); int(got) != len(probe) {
+		t.Fatalf("acked size %d, want %d", got, len(probe))
+	}
+}
+
 func TestDropsReplayBadHmacAndUnknownPrefix(t *testing.T) {
 	mgr, addr := startServer(t)
 	sess, _, err := mgr.New("dev1", "credential-ikm", netip.MustParseAddr("127.0.0.1"))