Add NAT traversal: public address discovery, UDP hole punching, and keep-alive

[Copilot]

Nodes behind NAT routers have no mechanism to discover their public address or establish direct peer connections. This adds a NAT traversal subsystem integrated with the existing UDP networking stack.

New: src/nat_traversal.rs

• NatType — Open | FullCone | RestrictedCone | PortRestrictedCone | Symmetric | Unknown
• HolePunchMessage — wire protocol: DiscoverRequest/Response, CoordinateHolePunch, HolePunchProbe/Ack, KeepAlive
• NatTraversalConfig — discovery/punch timeouts, attempt count, keep-alive interval, enabled flag
• NatTraversalManager — core engine:
  • discover_public_addr(reflector) — learn externally-observed address via reflector peer
  • probe_nat_type_with_reflectors(r1, r2) — same external port from two reflectors → cone NAT; different → Symmetric
  • initiate_hole_punch(socket, remote) — burst probes + wait for ack, records confirmed session
  • handle_message(msg, sender) — serves reflector, coordinator, and responder roles
  • send_keep_alive(socket) — periodic packets to all traversal peers to maintain NAT mappings

src/node.rs

• NodeConfig gains nat_traversal: NatTraversalConfig (enabled by default)
• ChaincraftNode gains nat_traversal: Option<Arc<NatTraversalManager>>
• start_networking() initialises the manager, routes NAT messages before the general UDP handler, and spawns a background keep-alive task
• Builder: .nat_traversal(bool), .with_nat_traversal_config(config)
• Node: set_nat_traversal_enabled(), nat_traversal_manager()

src/error.rs

Two new NetworkError variants: NatDiscoveryFailed { reason } and HolePunchFailed { addr, reason }.

Usage sketch

// Custom config
let node = ChaincraftNode::builder()
    .port(8080)
    .with_nat_traversal_config(NatTraversalConfig {
        hole_punch_attempts: 5,
        keep_alive_interval: Duration::from_secs(25),
        ..Default::default()
    })
    .build()?;

// After node.start(), the manager is live:
let mgr = node.nat_traversal_manager().unwrap();
let public_addr = mgr.discover_public_addr(reflector_addr).await?;
let session_id  = mgr.initiate_hole_punch(&socket, peer_addr).await?;

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Add NAT Traversal feature</issue_title>
<issue_description></issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Add NAT Traversal feature #6

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.