engine, messages, util, imsd: the reregistration carries the last challenge answer and new SA parameters

The keepalive refresh and the resume's re-REGISTER carried an initial
registration's first-REGISTER Authorization — an empty nonce and
response — in the second REGISTER's frame, with a Security-Client
naming the SPIs and ports in use. TS 24.229 5.1.1.4.2 has a
reregistration carry the Authorization
of the last successful authentication — the last received nonce and
the last calculated response — and a Security-Client with the new
parameter values for the two SA pairs a re-authentication would set
up; TS 33.203 7.4.0 keeps the server ports and changes the client
ports. O2 UK refused the refresh of the old shape with 503 on every
occasion on record (alyx, 2026-09-24 to 10-08, a stationary phone
included) and accepted the fresh registrations that followed; KPN
accepted the old shape without a challenge.

The fresh registration now records the 401's nonce, our cnonce and
the response in the registration state (auth_nonce, auth_cnonce,
auth_response in the state file); a reregistration sends them
verbatim, mints new SPIs and proposes PortUcNext (45063) as the
client port with the server port unchanged. A registration resumed from a
state file written before this change has no answer: its
reregistrations carry the empty digest, as before, until its next
fresh registration, and the resume says so. A 401 to a reregistration asks
for re-authentication over temporary SAs on the proposed ports (TS
24.229 5.1.1.5.1), which imsd does not implement: the refresh throws
it as a refusal and RegRecovery makes the next step the fresh
registration, replacing the in-place answer over the old SAs.

Tested with the Messages and Engine suites and on the dev phone (KPN)
with a build of this commit's tree: a resume from the previous state
file, a fresh registration, a resume that sent the stored answer,
three refreshes at a 120-s interval, an outgoing call to a bench line
and an incoming call's ring.

tests/Engine/main.cpp

@@ -900,6 +900,17 @@ int main() {
             k.OnSuccess();
             Check(k.Reconnectable(), "success forgets it");
         }
+        // a 401 to a refresh asks for re-authentication over temporary SAs,
+        // which imsd does not do: the fresh registration at once, the old
+        // SA kept (the network still holds the registration)
+        {
+            RegRecovery j;
+            j.OnReconnectFailure(1000, F::Refused, 0, 401);
+            Check(j.Fresh() && j.Reconnectable() && j.refusals == 1 && freshAt(j, 1000, 1005), "a 401 on the first refusal: the fresh attempt after the backoff");
+            RegRecovery jr;
+            jr.OnReconnectFailure(1000, F::Refused, 0, 503);
+            Check(!jr.Fresh() && reconnectAt(jr, 1000, 1005), "a bare 503 (no Retry-After) is still the hiccup case: one more refresh first");
+        }
         // O2 10:43: the flow killed 8 s after the 200, every SYN unanswered
         r.OnReconnectFailure(1000, F::Silent);
         Check(!r.Fresh() && reconnectAt(r, 1000, 1005), "first silent cycle: retry in 5 s");

tests/Messages/main.cpp

@@ -192,6 +192,20 @@ int main() {
            Reg2, "protected REGISTER");
     }
 
+    // ---- a reregistration (the keepalive refresh, a resume): the last
+    // challenge answer verbatim, new SPIs and a new client port in
+    // Security-Client, the server port unchanged (TS 24.229 5.1.1.4.2,
+    // TS 33.203 7.4.0)
+    {
+        std::string auth = AuthAka(c, "NONCEXYZ", "CNONCE0123456789", "RESP0000");
+        std::string r3 = BuildRegisterProtected(c, "REGCALLID@2001:db8::db43", "FTAG5678", "REGBRANCH123456", 3, 55555u, 66666u, auth, 45063);
+        Check(r3.contains("\r\nSecurity-Client: ipsec-3gpp; alg=hmac-sha-1-96; ealg=aes-cbc; spi-c=55555; spi-s=66666; port-c=45063; port-s=45062\r\n"), "refresh Security-Client: new SPIs, a new client port, the same server port");
+        Check(r3.contains("\r\nCSeq: 3 REGISTER\r\n") && r3.contains("\r\nVia: SIP/2.0/TCP [2001:db8::db43]:45062;") && r3.contains("@[2001:db8::db43]:45062>"), "refresh: CSeq+1, the server port in Via and Contact");
+        Check(r3.contains(std::format("\r\n{}\r\n", auth)), "refresh carries the last challenge answer verbatim");
+        std::string r3same = BuildRegisterProtected(c, "REGCALLID@2001:db8::db43", "FTAG5678", "REGBRANCH123456", 3, 55555u, 66666u, auth);
+        Check(r3same.contains("port-c=45061; port-s=45062\r\n"), "without a client port the in-use one is offered (the initial registration's second REGISTER)");
+    }
+
     // ---- protected-leg transport follows Context.transport (SIP_TRANSPORT=udp,
     // or the auto fallback): every protected request's Via says UDP, the
     // challenge's Via stays UDP either way, and TCP is the untouched default.