server: send granted traffic from the address the session actually used

fmr binds two IPv4 addresses. connFor picked whichever socket of the right
family came first in the bind list, so a downtrain for a session established on
.150 went out from .151 — and every packet was dropped by the client's NAT,
which has no mapping for that pair. tcpdump on the server showed all 50 leaving;
the client saw none. Read as "100% downstream loss", which is the worst kind of
wrong: a confident measurement of something that never happened.

Sessions now record which of our own bound addresses received their traffic, and
granted sends (and delayed echo) go back out through that socket. The fallback
to a family match is kept for the case where nothing has been received yet, and
the test pins both paths — a single-homed lab can never reproduce this.

Also: the client-side halves of the same work — anonymizer (core-privacy), local
run archive with retention (core-archive), upload client, and the app's settings
and history screens.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/internal/dataplane/udp.go

@@ -73,9 +73,23 @@ func (s *Server) Serve(conn *net.UDPConn) error {
 }
 
 // connFor picks a retained socket whose family matches the target.
-func (s *Server) connFor(target netip.AddrPort) *net.UDPConn {
+// connFor picks the socket to send to target from.
+//
+// When the session recorded which local address it has been talking to (local), that socket wins
+// outright. Falling back to "any socket of the right family" is only correct for a single-homed
+// server: on a multi-homed one it sends from a sibling address the client's NAT has no mapping
+// for, the packets are dropped in transit, and the client reports downstream loss that does not
+// exist. That bug is invisible in a lab with one address, which is exactly why this is explicit.
+func (s *Server) connFor(target, local netip.AddrPort) *net.UDPConn {
 	s.mu.Lock()
 	defer s.mu.Unlock()
+	if local.IsValid() {
+		for _, c := range s.conns {
+			if c.LocalAddr().(*net.UDPAddr).AddrPort() == local {
+				return c
+			}
+		}
+	}
 	want4 := target.Addr().Unmap().Is4()
 	for _, c := range s.conns {
 		la := c.LocalAddr().(*net.UDPAddr).AddrPort()
@@ -94,7 +108,7 @@ func (s *Server) SendDelayedEcho(sess *session.Session, actionID string) error {
 	if !target.IsValid() {
 		return fmt.Errorf("session has no observed data-plane source yet")
 	}
-	conn := s.connFor(target)
+	conn := s.connFor(target, sess.DataLocal())
 	if conn == nil {
 		return fmt.Errorf("no data-plane socket matches target family")
 	}
@@ -131,6 +145,9 @@ func (s *Server) handle(conn *net.UDPConn, raddr netip.AddrPort, pkt []byte, tRx
 		return
 	}
 	sess.NoteDataSource(raddr)
+	if la, ok := conn.LocalAddr().(*net.UDPAddr); ok {
+		sess.NoteDataLocal(la.AddrPort())
+	}
 	sess.RecordUDP(session.UDPObservation{
 		Seq: seq, TRxNs: tRxNs, TTxNs: time.Since(s.start).Nanoseconds(),
 		Src: raddr.String(), Size: len(pkt), Type: typ,