server: send granted traffic from the address the session actually used

fmr binds two IPv4 addresses. connFor picked whichever socket of the right
family came first in the bind list, so a downtrain for a session established on
.150 went out from .151 — and every packet was dropped by the client's NAT,
which has no mapping for that pair. tcpdump on the server showed all 50 leaving;
the client saw none. Read as "100% downstream loss", which is the worst kind of
wrong: a confident measurement of something that never happened.

Sessions now record which of our own bound addresses received their traffic, and
granted sends (and delayed echo) go back out through that socket. The fallback
to a family match is kept for the case where nothing has been received yet, and
the test pins both paths — a single-homed lab can never reproduce this.

Also: the client-side halves of the same work — anonymizer (core-privacy), local
run archive with retention (core-archive), upload client, and the app's settings
and history screens.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/internal/canarydns/canarydns.go

@@ -39,13 +39,13 @@ const (
 
 // Query is one logged canary lookup (spec §6 dns_canary shape).
 type Query struct {
-	QName        string    `json:"qname"`
-	At           time.Time `json:"at"`
-	ResolverIP   string    `json:"resolver_ip"`
-	Transport    string    `json:"transport"` // "udp" | "tcp"
-	EDNS         edns      `json:"edns"`
-	ECS          string    `json:"ecs,omitempty"`
-	CasePreserved bool     `json:"case_preserved"`
+	QName         string    `json:"qname"`
+	At            time.Time `json:"at"`
+	ResolverIP    string    `json:"resolver_ip"`
+	Transport     string    `json:"transport"` // "udp" | "tcp"
+	EDNS          edns      `json:"edns"`
+	ECS           string    `json:"ecs,omitempty"`
+	CasePreserved bool      `json:"case_preserved"`
 	// qname_minimized is not reliably detectable authoritative-side without
 	// cross-query correlation; left false (TODO) rather than guessed.
 	QNameMinimized bool `json:"qname_minimized"`
@@ -59,8 +59,8 @@ type edns struct {
 
 // Server is the authoritative responder for one canary zone.
 type Server struct {
-	zone     string // fully-qualified, lowercase, trailing dot, e.g. "c.echo-lot.app."
-	nsName   string // this server's own name for NS/authority answers
+	zone      string // fully-qualified, lowercase, trailing dot, e.g. "c.echo-lot.app."
+	nsName    string // this server's own name for NS/authority answers
 	primaryV4 netip.Addr
 	primaryV6 netip.Addr
 
@@ -284,4 +284,3 @@ func (s *Server) errorResponse(id uint16, rcode int, opt *optInfo) []byte {
 	}
 	return hdr
 }
-

server/internal/canarydns/canarydns_test.go

@@ -21,7 +21,7 @@ func buildQuery(name string, qtype uint16, ednsBufsize int) []byte {
 	msg = binary.BigEndian.AppendUint16(msg, classIN)
 	if ednsBufsize > 0 {
 		binary.BigEndian.PutUint16(msg[10:12], 1) // ARCOUNT
-		msg = append(msg, 0)                       // root name
+		msg = append(msg, 0)                      // root name
 		msg = binary.BigEndian.AppendUint16(msg, typeOPT)
 		msg = binary.BigEndian.AppendUint16(msg, uint16(ednsBufsize))
 		msg = binary.BigEndian.AppendUint32(msg, 0)