sip: UDP for the protected leg, TCP first with a fallback

imsd's protected leg (the second REGISTER and everything after it) was
TCP only. A P-CSCF that never answers the TCP connect on its protected
server port (O2 UK: the SYNs leave ESP-protected, nothing comes back)
left the unit looping with no way forward, although the SAs, the
listener sockets and the firewall rule already covered UDP.

The client flow now carries a transport. UDP binds the same protected
client port and connect()s the datagram socket to the P-CSCF's protected
server port, so the kernel delivers that peer's datagrams to it ahead of
the unconnected listener on the same port. One datagram is one message
(RFC 3261 18.3: a Content-Length that fits truncates, one that does not
fit discards the datagram, none means the rest of the datagram); a
receive error is logged and marks the flow dead; a message over the
single-packet ESP budget at the ims PDN's MTU is logged once per flow,
since the kernel fragments it and a P-CSCF may drop the fragments.
Every protected request's Via follows the transport; the challenge
stays UDP.

SIP_TRANSPORT selects the policy: auto (default) registers over TCP and,
after two unanswered connects, registers again over UDP (new challenge,
new SA pair) - but only on a phone whose state file does not record a
successful TCP registration, so an outage on a TCP carrier never becomes
a second initial REGISTER; a phone whose last registration was UDP goes
straight to UDP. tcp and udp force one. A connect refused locally
(EADDRNOTAVAIL: the 4-tuple still in TIME_WAIT from the previous flow)
keeps retrying and is not counted as silence; SO_ERROR results are
logged by name. The registration's transport is persisted so a warm
resume reconnects the same way, and the resume gives up after two
silences.

Two things the change exposed and fixes: an engine-fatal event exited 0
("exiting for systemd restart" with Restart=on-failure never firing),
and a fresh registration refused with the P-CSCF's fresh-SA throttle
(Security-Server spi-s=0) must not be retried by a 120-s restart loop,
since every attempt re-arms the ~20-min window - it is now waited out
in-process, growing on repeats, with D-Bus commands still served. A
resume the network refuses falls through to a fresh registration. A
retransmitted 200 OK to our INVITE is ACKed again and no longer starts
a second media leg.

Verified on KPN: resume over TCP after a binary swap, MT and MO calls
with media both ways, the throttle deferral and its self-recovery, the
UDP client path up to KPN dropping the datagram. The UDP success path
is a field test; SIP retransmission timers over UDP are not in this
change.

interfaces/Imsd-Sip.cppm

@@ -233,4 +233,36 @@ export namespace imsd::sip {
     private:
         std::string buf_;
     };
+
+    // The SIP message carried by one UDP datagram (RFC 3261 18.3): a
+    // datagram is never accumulated with the next. Leading CRLFs (an RFC
+    // 5626 keepalive pong) are not a message → nullopt, no problem. A
+    // Content-Length that fits truncates the body to it; one that does not
+    // fit is a truncated datagram → nullopt with `problem` set; no
+    // Content-Length means the body is the rest of the datagram. A datagram
+    // without a header terminator is malformed → nullopt with `problem`.
+    std::optional<std::string> DatagramMessage(std::string_view d, std::string* problem = nullptr) {
+        std::size_t start = d.find_first_not_of("\r\n");
+        if (start == std::string_view::npos) return std::nullopt;
+        d.remove_prefix(start);
+        std::size_t idx = d.find("\r\n\r\n");
+        if (idx == std::string_view::npos) {
+            if (problem) *problem = std::format("datagram without a header terminator ({} bytes)", d.size());
+            return std::nullopt;
+        }
+        std::size_t bodyStart = idx + 4;
+        std::size_t body = d.size() - bodyStart;
+        if (auto v = Header(d.substr(0, idx), "Content-Length")) {
+            std::size_t clen = 0; int digits = 0;
+            for (char c : *v) { if (c < '0' || c > '9' || digits == 9) break; clen = clen * 10 + static_cast<std::size_t>(c - '0'); digits++; }
+            if (digits) {
+                if (clen > body) {
+                    if (problem) *problem = std::format("datagram truncated (Content-Length {} > {} body bytes)", clen, body);
+                    return std::nullopt;
+                }
+                return std::string(d.substr(0, bodyStart + clen));
+            }
+        }
+        return std::string(d);
+    }
 }