B1+B2+B3: bearer-neutral peer discovery (AGW UI + UDP multicast)

[M0LTE]

The plan sketched an `IDappsUiTransport` interface that was AGW-flavoured. After the A0 backhaul-seam work it makes more sense to lift discovery to the same level — bearer-neutral. Implemented two bearers in this PR; daemon runs whichever are configured.

Seam (`dapps.client/Discovery/`)

```csharp
public interface IDiscoveryBearer : IAsyncDisposable
{
string Name { get; }
Task StartAsync(CancellationToken ct);
Task AnnounceAsync(BeaconFrame beacon, CancellationToken ct);
IAsyncEnumerable ListenAsync(CancellationToken ct);
}
```

`BeaconFrame` carries callsign + hops + ttl + a bearer hint that's stamped by the receiver (never on wire, so a peer can't claim a route it doesn't have).

`BeaconCodec` wire form: `DAPPS v1 callsign=M0LTE-9 hops=0 ttl=300`. KV style rather than positional so future fields slot in without breaking parsers.

Bearers

• `AgwUiDiscoveryBearer` — dedicated AGW TCP socket; registers our callsign with `X`, enables monitor mode with `m`, sends beacons via `M`, filters incoming `U` frames for DAPPS payloads. Self-echoes filtered by callsign. Off by default; opt in via `DAPPS_AGW_DISCOVERY=true`.
• `UdpMulticastDiscoveryBearer` — joins a configurable IP multicast group (e.g. `239.42.42.42:1881`). Useful for LAN dev/testing without a BPQ stack — every DAPPS instance on the same subnet sees every other instance's beacons within seconds. Off by default; opt in via `DAPPS_MULTICAST_GROUP`.

Daemon

`DiscoveryService` is the hosted background service. Constructs bearers from options inside `ExecuteAsync` (not via a DI factory, because the options-config callback queries the systemoptions table which `DbStartup` hasn't created at the moment hosted services are first materialised).

Per bearer: emits our beacon every `DiscoveryBeaconIntervalSeconds` (default 300), concurrently iterates the listen stream, upserts `DbDiscoveredPeer` rows. Sweeper drops rows whose freshness window has elapsed.

`DbDiscoveredPeer` is keyed on `(Callsign, Bearer)` so the same peer reachable via two bearers occupies two rows; routing-resolver work (B4) can pick.

The dashboard now surfaces discovered peers (callsign + bearer + hops + source + age + ttl).

Smoke test

Two DAPPS instances on the same loopback multicast group (`239.42.42.42:41999`):

```
A: heard N0BBB-9 via udp (hops=0, ttl=60s)
B: heard N0AAA-9 via udp (hops=0, ttl=60s)
```

Within ~50ms of startup. Dashboard rows confirmed.

Drive-by

`AgwOutboundTransport.AgwConnection.DisposeAsync` now sends a `'d'` (disconnect) frame so BPQ tears down the AX.25 session promptly rather than leaving it for the link's idle timeout. Best-effort with a 2s budget.

Test plan

• 232 unit tests pass.
• `BeaconCodecTests` (10) — encode + decode round-trip, trailing-newline tolerance, malformed-input rejection, forward-compat unknown keys.
• `UdpMulticastDiscoveryTests` (8) — loopback announce + hear; own-beacon filter; bad-group parse paths.
• `AgwUiDiscoveryTests` (3) — `FakeAgwServer` over loopback TCP captures the X / m / M sequence; pushes a U frame back; bearer yields the parsed beacon and ignores wrong kinds / own echoes.
• `DiscoveryStorageTests` (4) — composite-key upsert idempotent, same callsign different bearer → two rows, age-out by ttl.
• Existing two-instance integration smoke (`TwoInstanceAgwSmokeTests`) flakes locally when sequenced after `TtlForwardingIntegrationTests` (state leak in the shared docker fixture, AX.25 link from prior test still up). Passes in isolation. Watching CI.

Plan.md

B1+B2+B3 marked done; B4 (resolver consulting `DbDiscoveredPeer`) and B5 (MeshCore-inspired flood-and-learn) remain.

🤖 Generated with Claude Code