Peer connection events + Unbounded integration + manual port forward

[myleshorton]

Summary

Three related additions on top of the in-flight peer-share work (#460):

1. Peer connection events: peer.ConnectionEvent fires on every samizdat accept/close, fed by lantern-box's new tracker/peerconn listener (lantern-box#255). Lantern-core subscribes and forwards via the existing FlutterEvent bridge so the UI globe can render arcs as remote clients connect.
2. Manual port-forward override: new portforward.ManualForwarder for users on networks where UPnP doesn't work (router has UPnP off, ISP gateway without IGD, double-NAT). Configured via either the new `settings.PeerManualPortKey` (UI-driven) or `RADIANCE_PEER_EXTERNAL_PORT` env var (developer override). Resolution order in `peer.Client.Start`: setting > env var > UPnP discovery.
3. Unbounded integration: new self-contained `unbounded` package wrapping the broflake widget-proxy lifecycle. Subscribes to `config.NewConfigEvent`, manages start/stop based on three conditions (local opt-in setting, server feature flag, server-supplied UnboundedConfig). Each consumer connection emits `unbounded.ConnectionEvent` on the radiance event bus — same shape as peer.ConnectionEvent so consumers can feed both protocols into a single Flutter event stream.

What's new vs. base branch

```mermaid
sequenceDiagram
autonumber
participant Box as lantern-box samizdat
participant Peer as radiance/peer
participant Bus as radiance/events
participant Unbnd as radiance/unbounded
participant Backend as LocalBackend

Box->>Peer: peerconn.Notify(+1, "ip:port")<br/>(lantern-box#255 hook)
Peer->>Bus: events.Emit(ConnectionEvent{State:+1, Source:"ip:port"})
Note over Backend: backend/radiance.go:Start<br/>unbounded.InitSubscription()
Backend->>Unbnd: subscribe to config.NewConfigEvent
Note over Unbnd: when settings.UnboundedKey<br/>+ Features[unbounded]<br/>+ cfg.Unbounded all hold
Unbnd->>Bus: events.Emit(ConnectionEvent{State:+1, Addr:"ip"})
rect rgba(200, 255, 200, 0.3)
    Note over Bus: lantern-core subscribes to BOTH<br/>and forwards as one FlutterEvent type
end

```

Test plan

• `go test ./peer/... ./portforward/... ./unbounded/...` clean
• `go build ./...` clean (cmd/lantern build error is pre-existing, unrelated)
• End-to-end on macOS: with the matching lantern branch and a local SmC peer, ConnectionEvents flow through to the globe
• Manual port: `RADIANCE_PEER_EXTERNAL_PORT=5698` causes peer.Client to skip UPnP and bind 5698 directly
• Unbounded: with settings.UnboundedKey=true and a server feature flag rollout, broflake widget proxy actually runs

Caveats

• Local `replace github.com/getlantern/lantern-box => ../lantern-box` in go.mod — needs to come out before merge once lantern-box#255 is tagged.
• `unbounded` package lives at the repo root rather than under `vpn/` because the in-flight `adam/unbounded-widget-proxy` branch refactors `vpn/` heavily and we want this to land independently.

Related

• lantern-box: Add peerconn listener registry for inbound connection lifecycle events lantern-box#255 (peerconn listener registry — must merge first or coordinated)
• lantern: `getlantern/lantern#TBD` (Flutter UI consumes the FlutterEvent stream this feeds)

🤖 Generated with Claude Code