engine, messages, util, imsd: the reregistration carries the last challenge answer and new SA parameters

The keepalive refresh and the resume's re-REGISTER carried an initial
registration's first-REGISTER Authorization — an empty nonce and
response — in the second REGISTER's frame, with a Security-Client
naming the SPIs and ports in use. TS 24.229 5.1.1.4.2 has a
reregistration carry the Authorization
of the last successful authentication — the last received nonce and
the last calculated response — and a Security-Client with the new
parameter values for the two SA pairs a re-authentication would set
up; TS 33.203 7.4.0 keeps the server ports and changes the client
ports. O2 UK refused the refresh of the old shape with 503 on every
occasion on record (alyx, 2026-09-24 to 10-08, a stationary phone
included) and accepted the fresh registrations that followed; KPN
accepted the old shape without a challenge.

The fresh registration now records the 401's nonce, our cnonce and
the response in the registration state (auth_nonce, auth_cnonce,
auth_response in the state file); a reregistration sends them
verbatim, mints new SPIs and proposes PortUcNext (45063) as the
client port with the server port unchanged. A registration resumed from a
state file written before this change has no answer: its
reregistrations carry the empty digest, as before, until its next
fresh registration, and the resume says so. A 401 to a reregistration asks
for re-authentication over temporary SAs on the proposed ports (TS
24.229 5.1.1.5.1), which imsd does not implement: the refresh throws
it as a refusal and RegRecovery makes the next step the fresh
registration, replacing the in-place answer over the old SAs.

Tested with the Messages and Engine suites and on the dev phone (KPN)
with a build of this commit's tree: a resume from the previous state
file, a fresh registration, a resume that sent the stored answer,
three refreshes at a 120-s interval, an outgoing call to a bench line
and an incoming call's ring.

interfaces/Imsd-Util.cppm

@@ -24,6 +24,12 @@ export namespace imsd::util {
     // an installed package's nftables accept rules.
     constexpr int PortUc = 45061;
     constexpr int PortUs = 45062;
+    // The client port a reregistration proposes for the SA pairs a
+    // re-authentication would set up: TS 33.203 7.4.0 keeps the server
+    // ports (port_us, port_ps) and changes the client ports (port_uc,
+    // port_pc). imsd answers such a challenge with a fresh registration, so
+    // nothing is bound here and the firewall rules need not open it.
+    constexpr int PortUcNext = 45063;
 
     // An address is IPv6 iff it contains a colon (matches the Python is6()).
     inline bool Is6(std::string_view addr) { return addr.contains(':'); }