feat(ctrl): define tunnel control messages

Add the reliable control-plane schema that will run over QUIC streams. This
covers the phase-1 handshake shape without mixing in relay sockets, TAP access,
or gateway packet IO.

The schema includes endpoint hello messages with role, room, MAC, and datagram
budget, plus server welcome, rejection, peer lifecycle, stats, and disconnect
messages. Constructors and validation enforce room-code syntax, client MAC
identity rules, reserved peer IDs, and effective TAP MTU limits. Decoded control
messages can be validated explicitly so serde input cannot silently bypass the
same invariants.

The actual stream codec remains future work; this commit only fixes the typed
contract the codec will carry.

Test Plan:
- cargo fmt --check
- cargo test --workspace
- cargo clippy --workspace --all-targets -- -D warnings

Refs: PLAN.md reliable QUIC control stream requirements

README.md

@@ -21,6 +21,14 @@ Transport-agnostic tunnel contract shared by all binaries:
 - MAC address parsing and identity validation
 - QUIC datagram to TAP MTU budget helpers
 
+### `lanparty-ctrl`
+
+Reliable control-plane schema shared by the QUIC stream handlers:
+
+- endpoint hello messages with role, room, MAC, and datagram budget
+- server welcome, reject, peer lifecycle, stats, and disconnect messages
+- room-code, role/MAC, peer-id, and effective-MTU validation
+
 ## Build
 
 ```bash