v4.6.0-preview.2 — STUN/TURN server, WebRTC RTCP quality & SIP compliance

[BechsteinDigital]

v4.6.0-preview.2

A large RFC-compliance and hardening release on top of the preview.1 WebRTC facade —
145 source files changed (~9.9k insertions) across ~50 PRs since v4.6.0-preview.1.
No breaking API changes.

✨ Added

• Self-hostable STUN & TURN server — AddCalloraStunServer(...) / AddCalloraTurnServer(...)
  with TURN control over UDP/TCP/TLS (end-to-end covered), inbound FINGERPRINT validation on both
  servers, DONT-FRAGMENT on the relay socket, and EVEN-PORT + RESERVATION-TOKEN (RFC 8656 §7).
• TURN relay lifecycle (RFC 8656 §9/§12) — permission-refresh and channel-rebind keepalive
  loops that hold a real allocation alive across more than one lifetime (CF-003).
• RTCP quality on the WebRTC/BUNDLE media path (RFC 3550, CF-004a–g) — periodic Sender/Receiver
  Reports, per-SSRC reception statistics, RTT from RR/SR, report-block paging (no overflow loss),
  negotiated-clock-rate §A.8 jitter with NTP↔RTP SR extrapolation, and per-SSRC/MID quality
  snapshots on WebRtcStats (JitterMs et al.); verified two-peer over real DTLS-SRTCP.
• DTMF (RFC 4733) end-to-end on the WebRTC/BUNDLE path (CF-007).
• SHA-512-256 SIP digest auth (RFC 8760, CF-001) resolving a multi-challenge deadlock; digest
  qop=auth-int (RFC 7616, CF-067a); RFC 5626 outbound ;ob contact parameter (CF-067b).
• THIRD-PARTY-NOTICES.md — license attribution for all runtime dependencies.

---

This discussion was created from the release v4.6.0-preview.2 — STUN/TURN server, WebRTC RTCP quality & SIP compliance.