feat(client): pin relay route before opening TAP

Create the relay host-route pin in the Windows client before the TAP adapter is
opened and marked connected. The guard is held until after `ClientSession`
shutdown so both the active tunnel and the QUIC close path keep using the
pre-TAP interface.

Route inspection or route creation failure now aborts startup before TAP
activation, and the client explicitly closes the relay session in that failure
path. Once the pin is installed, the client reports both the original best-route
snapshot and the pinned route. Default-route takeover detection/neutralization
is still future work.

Verification note: I attempted to check `lanparty-client-win` for
`x86_64-pc-windows-msvc`, but this host still lacks the Windows C headers
needed by `ring`; the build stops at `assert.h` before the binary crate can be
typechecked for Windows.

Test Plan:
- cargo fmt --check
- cargo test --workspace
- cargo clippy --workspace --all-targets -- -D warnings
- cargo check -p lanparty-client-route --target x86_64-pc-windows-msvc
- cargo clippy -p lanparty-client-route --target x86_64-pc-windows-msvc --all-targets -- -D warnings
- git diff --check

Refs: PLAN.md

README.md

@@ -131,9 +131,10 @@ cargo run -p lanparty-client-win -- \
 The Windows client binary currently connects to the relay as `role = client`
 with a generated locally administered virtual MAC persisted in
 `lanparty-client-identity.json`, completes the control-stream hello/welcome
-handshake, snapshots the current relay route, and then bridges Ethernet frames
-between the relay and the first TAP-Windows6 adapter until shutdown.
+handshake, pins a host route for the relay IP on the current pre-TAP interface,
+and then bridges Ethernet frames between the relay and the first TAP-Windows6
+adapter until shutdown.
 `--virtual-mac` can still override the stored identity for manual testing. On
 Windows it marks the TAP media connected and reports the driver MAC/MTU before
-forwarding frames. Route pinning and automatic TAP MAC/MTU configuration are
-not wired yet.
+forwarding frames. Default-route takeover neutralization and automatic TAP
+MAC/MTU configuration are not wired yet.