fix(client): verify relay route before TAP activation

The Windows client pinned the relay host route before opening TAP, but only
verified that Windows was actually using that host route after TAP activation.
If an existing route or pinning failure prevented the host route from becoming
the active relay path, the client could discover that only after touching TAP
route policy.

Verify the pinned host route immediately after installing/reusing it, before
opening the TAP adapter. Keep the existing after-activation verification as the
runtime guard against TAP route takeover, and document the new expected startup
log line in the MVP guide.

Test Plan:
- cargo fmt --check
- cargo test -p lanparty-client-win
- cargo test --workspace
- cargo clippy --workspace --all-targets -- -D warnings
- cargo check -p lanparty-client-route --target x86_64-pc-windows-msvc
- git diff --check
- git diff --cached --check

Windows-target check attempted:
- cargo check -p lanparty-client-win --target x86_64-pc-windows-msvc

With LLVM tools configured, that still stops inside ring on this Linux host
because the Windows C headers are unavailable, starting with assert.h.

Refs: MVP relay-route protection

README.md

@@ -240,10 +240,10 @@ stale connected state from a previous crashed run without letting the TAP
 adapter influence relay DNS or route selection. The client then resolves the
 relay endpoint, completes the control-stream hello/welcome handshake, pins a
 host route for the resolved relay IP on the current pre-TAP interface, verifies
-that the relay route still uses that pinned host route after TAP activation,
-and bridges Ethernet frames between the relay and the TAP-Windows6 adapter
-until shutdown. `--relay` accepts a DNS name or socket address; bare hosts
-default to UDP/443.
+that Windows is already using that host route, verifies it again after TAP
+activation, and bridges Ethernet frames between the relay and the TAP-Windows6
+adapter until shutdown. `--relay` accepts a DNS name or socket address; bare
+hosts default to UDP/443.
 TAP frames whose source MAC does not match that generated tunnel MAC are
 dropped locally before they can consume relay bandwidth; the relay still
 enforces the same source-MAC rule.