fix(call-to-play): acknowledge live replication

Raise the wire protocol to version 7 and add explicit Call to Play delivery
outcomes. Live requests now wait for an application acknowledgement, allowing
the sender to distinguish applied, duplicate, obsolete, incomplete, and
rejected updates instead of treating a successful write as acceptance.

Remove source-IP equality from actor verification. The receiver now requires
the envelope peer ID to be present in its known roster and requires every live
event actor to match that envelope. This matches the cooperative-LAN trust
model without misrepresenting the shared TLS identity as per-peer
authentication.

Transport failures, malformed responses, NeedHandshake, and NeedHistory each
trigger one asynchronous Hello/HelloAck resync. Rejections are logged without
retry, and local publication remains independent of remote availability.

Test Plan:
- `just fmt` -- passed
- `just clippy` -- passed
- `just test` -- passed
- `git diff --cached --check` -- passed

crates/lanspread-proto/src/lib.rs

@@ -4,7 +4,7 @@ use bytes::Bytes;
 use lanspread_db::db::{Game, GameFileDescription};
 use serde::{Deserialize, Serialize};
 
-pub const PROTOCOL_VERSION: u32 = 6;
+pub const PROTOCOL_VERSION: u32 = 7;
 
 pub use lanspread_db::db::Availability;
 
@@ -74,6 +74,16 @@ pub enum CallToPlayAction {
     },
 }
 
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+pub enum CallToPlayAck {
+    Applied,
+    Duplicate,
+    NeedHandshake,
+    NeedHistory,
+    Obsolete,
+    Rejected { reason: String },
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct LibrarySnapshot {
     pub library_rev: u64,
@@ -130,6 +140,7 @@ pub enum Response {
         file_descriptions: Vec<GameFileDescription>,
     },
     HelloAck(HelloAck),
+    CallToPlayAck(CallToPlayAck),
     GameNotFound(String),
     InvalidRequest(Bytes, String),
     EncodingError(String),