Add fallback_port support so invalid TCP/UDP conceal traffic is proxied to a local fallback service instead of being dropped.
Also add typed conceal format errors, preserve consumed bytes for TCP fallback replay, wire fallback config through UAPI/binds/Outline, and cover TCP, UDP, and UAPI behavior with tests.
Move UDP conceal above the UDP bind so conceal-enabled Windows UDP can run
over WinRingBind instead of forcing a StdNetBind fallback.
Add a bind-level UDP conceal middleware that:
- encodes outbound WireGuard packets with framed and masquerade rules
- injects prelude decoys and junk before initiation packets
- wraps ReceiveFuncs to decode inbound datagrams and drop invalid decoy,
junk, and prelude packets before they reach device
Extract transport-agnostic UDP packet helpers in conceal so framing,
masquerade, and prelude logic is shared across WinRingBind and StdNetBind.
Keep the TCP conceal path unchanged in BindStream, remove the old Windows
fast/fallback UDP selector, and add focused bind-level conceal tests.
Frog Rocky