Replace session ID + PIN auth with HKDF-derived home secret and
per-session AES-256-GCM encrypted channel. Auto-start remote server
on host devices, auto-discover hosts via authenticated UDP broadcast.
- Dispose old discovery service before creating new one in loadRecentSessions()
- Host waits for client reconnect instead of calling joinSession
- Clear stale error messages on successful reconnect
- Rate limit auth attempts (5 tries, 30s lockout)
- Use Random.secure() for peer ID
- Extract shared ACK helper methods
edde746