feat(client): persist virtual MAC identity

Remote clients need a stable locally administered MAC address so the relay,
gateway, DHCP lease, and LAN peers keep seeing the same tunnel identity across
runs. Requiring users to pass `--virtual-mac` made that responsibility manual.

Add a platform-neutral client identity store that loads a JSON identity file or
generates a new valid virtual MAC with OS randomness and persists it. The file
stores the MAC in the same string form shown by the CLI. The Windows client now
uses `lanparty-client-identity.json` by default while keeping `--virtual-mac` as
a manual test override.

TAP binding still remains future work; this slice only owns the client identity
that will be assigned to the TAP adapter.

Test Plan:
- cargo fmt --check
- cargo test --workspace
- cargo clippy --workspace --all-targets -- -D warnings
- git diff --check

Refs: PLAN.md MAC identity

README.md

@@ -104,11 +104,12 @@ cargo run -p lanparty-client-win -- \
   --relay 203.0.113.10:443 \
   --server-name lanparty-relay.local \
   --relay-ca-cert relay-cert.der \
-  --room ROOM1 \
-  --virtual-mac 02:00:00:00:00:51
+  --room ROOM1
 ```
 
 The Windows client binary currently connects to the relay as `role = client`
-with the configured virtual MAC, completes the control-stream hello/welcome
-handshake, and then waits for shutdown. TAP adapter binding and route pinning
-are not wired yet.
+with a generated locally administered virtual MAC persisted in
+`lanparty-client-identity.json`, completes the control-stream hello/welcome
+handshake, and then waits for shutdown. `--virtual-mac` can still override the
+stored identity for manual testing. TAP adapter binding and route pinning are
+not wired yet.