fix(peer): preserve advertised addresses for QUIC peers

After renewing the dev certificate, peers could complete handshakes but then
lost each other during liveness checks. Inbound QUIC streams report the client's
ephemeral source port, while the peer database is supposed to track the peer's
advertised listening address. Recording the ephemeral address created unstable
peer entries that could not be pinged later.

Resolve transport source addresses back to the unique known peer on the same IP,
and keep an existing advertised address when an inbound Hello arrives from that
peer. Goodbye events now report the stored peer address as well.

This keeps the core peer behavior in lanspread-peer; the CLI only observes the
resulting peer snapshots.

Test Plan:
- just fmt
- just test
- just clippy
- just peer-cli-build
- just peer-cli-image
- just peer-cli-alpha, just peer-cli-bravo, just peer-cli-charlie
- list-peers after the ping idle window shows advertised peer addresses with
  populated game lists instead of ephemeral-port peers disappearing

Refs: PEER_CLI_SCENARIOS.md

crates/lanspread-peer/src/peer_db.rs

@@ -137,6 +137,30 @@ impl PeerGameDB {
         self.addr_index.get(addr)
     }
 
+    /// Returns the peer id for a transport source address.
+    ///
+    /// QUIC clients connect from ephemeral source ports, while peer records are
+    /// keyed by their advertised listening address. If the exact socket address
+    /// is unknown, fall back to a unique peer with the same IP address.
+    #[must_use]
+    pub fn peer_id_for_transport_addr(&self, addr: &SocketAddr) -> Option<PeerId> {
+        if let Some(peer_id) = self.addr_index.get(addr) {
+            return Some(peer_id.clone());
+        }
+
+        let mut matches = self
+            .peers
+            .values()
+            .filter(|peer| peer.addr.ip() == addr.ip())
+            .map(|peer| peer.peer_id.clone());
+        let peer_id = matches.next()?;
+        if matches.next().is_some() {
+            return None;
+        }
+
+        Some(peer_id)
+    }
+
     /// Returns the library state for a peer if known.
     #[must_use]
     pub fn peer_library_state(&self, peer_id: &PeerId) -> Option<(u64, u64)> {
@@ -201,7 +225,7 @@ impl PeerGameDB {
 
     /// Updates the last seen timestamp for a peer by address.
     pub fn update_last_seen_by_addr(&mut self, addr: &SocketAddr) {
-        if let Some(peer_id) = self.addr_index.get(addr).cloned()
+        if let Some(peer_id) = self.peer_id_for_transport_addr(addr)
             && let Some(peer) = self.peers.get_mut(&peer_id)
         {
             peer.last_seen = Instant::now();
@@ -815,6 +839,10 @@ mod tests {
         SocketAddr::from(([127, 0, 0, 1], port))
     }
 
+    fn ip_addr(ip: [u8; 4], port: u16) -> SocketAddr {
+        SocketAddr::from((ip, port))
+    }
+
     fn summary(id: &str, version: &str, availability: Availability) -> GameSummary {
         GameSummary {
             id: id.to_string(),
@@ -889,6 +917,29 @@ mod tests {
         assert!(db.peers_with_latest_version("game").is_empty());
     }
 
+    #[test]
+    fn transport_addr_matches_known_peer_on_ephemeral_port() {
+        let advertised = ip_addr([10, 66, 0, 2], 40000);
+        let transport_source = ip_addr([10, 66, 0, 2], 52000);
+        let mut db = PeerGameDB::new();
+        db.upsert_peer("peer".to_string(), advertised);
+
+        assert_eq!(
+            db.peer_id_for_transport_addr(&transport_source).as_deref(),
+            Some("peer")
+        );
+    }
+
+    #[test]
+    fn transport_addr_fallback_requires_unique_peer_ip() {
+        let source = ip_addr([10, 66, 0, 2], 52000);
+        let mut db = PeerGameDB::new();
+        db.upsert_peer("first".to_string(), ip_addr([10, 66, 0, 2], 40000));
+        db.upsert_peer("second".to_string(), ip_addr([10, 66, 0, 2], 41000));
+
+        assert_eq!(db.peer_id_for_transport_addr(&source), None);
+    }
+
     #[test]
     fn validation_uses_latest_version_file_metadata() {
         let old_addr = addr(12003);