feat(webrtc): add signaling-free WebRTC Direct transport

[mickvandijke]

Summary

Adds an optional, signaling-free WebRTC Direct transport for browser-to-Saorsa connections.

The transport lets a browser dial a public node directly over ICE-lite, DTLS, SCTP, and a reliable ordered DataChannel. It does not require DNS, a public-CA certificate, a signaling service, TURN, or a libp2p compatibility layer.

This is the transport foundation for direct Autonomi browser clients. Higher layers remain responsible for authenticating the advertised ANT identity and limiting the application protocol.

What changes

• Adds the opt-in webrtc-direct Cargo feature.
• Adds a WebRTC Direct listener backed by the existing UDP connection router.
• Generates and reloads stable P-256 DTLS certificates and exposes their SHA-256 multihash.
• Adds canonical WebRTC Direct transport addresses:
  • /ip4|ip6/<literal>/udp/<port>/webrtc-direct/certhash/<sha2-256>/p2p/<peer-id>
• Rejects DNS endpoints, malformed certificate hashes, and ambiguous address components.
• Routes STUN binding requests by ICE credentials before stale source-address mappings, allowing a browser to reconnect from a reused UDP source port.
• Supports the DTLS group negotiation used by current Chromium.
• Exposes reliable ordered DataChannels while preserving the existing QUIC transport behavior.
• Keeps the WebRTC dependency graph optional for QUIC-only consumers.

Security and resource model

• DTLS fingerprints are carried in the self-contained endpoint and checked during WebRTC setup.
• The DTLS key is a transport credential, not the application identity; downstream ant-node performs a challenge-bound ML-DSA HELLO before accepting RPCs.
• ICE credentials use the Saorsa-owned direct profile and are validated before association routing.
• Browser traffic is isolated from the existing node-to-node QUIC protocol.

Compatibility

• Existing QUIC addresses and APIs are unchanged.
• The new listener is disabled unless the webrtc-direct feature is enabled.
• No stored-data format changes.
• This adds a new public transport and therefore needs coordinated review with the downstream address, protocol, node, and client PRs.

Test evidence

• cargo test --features webrtc-direct --lib webrtc_direct
  • 7 WebRTC/address tests passed.
  • Covers certificate generation and pinning, address round trips/rejection, Saorsa ICE credentials, Chromium-compatible offers, and stale UDP mapping replacement.
• cargo fmt --all -- --check
• git diff --check
• Also exercised end-to-end by the downstream five-node ant-node integration test and headless Chromium client test.

Draft integration notes

• Linear issue: TBD before this stack is marked ready.
• This branch started from saorsa-transport v0.35.3 and currently needs rebasing onto the latest main.
• Downstream drafts pin this branch by commit SHA so CI remains reproducible while the stack is reviewed.
• Relayed WebRTC for nodes without a public UDP path is future work; this PR targets direct browser-to-public-node connectivity.

Rollback

Leave the feature disabled, or revert the feature and listener modules. Existing QUIC behavior is independent of this transport.

Coordinated draft stack

• This transport: saorsa-transport#160
• Addresses/shared lookup: saorsa-core#158
• Portable protocol: ant-protocol#29
• Node/browser RPC: ant-node#220
• ant-core/WASM client: ant-client#186

[github-actions]

Benchmark Results

Performance Comparison

Benchmark	Baseline	Current	Change	Status

Summary

Configuration

• Regression threshold: >10% slower
• Improvement threshold: >10% faster
• Measurements: Mean execution time