Harden IPv6 direct host checks

[Vrepol]

Closes #15

Summary

• Adds lightweight IPv6 client capability reporting on the connection selection screen.
• Adds host-mode IPv6 readiness reporting that combines socket availability, route detection, and public IPv6 candidate discovery.
• Tightens IPv6 advertise filtering to only treat global unicast IPv6 candidates as public invite candidates, excluding loopback, link-local, ULA, site-local-by-range, documentation, multicast/unspecified, and IPv4-mapped/compatible forms.
• Labels loopback candidates as local test only and updates host-mode success copy to avoid implying firewall bypass.
• Documents the IPv6 Direct Host boundary: no STUN/TURN/ICE, UDP hole punching, UPnP, NAT-PMP, or PCP in this issue.

Scope notes

This PR keeps the existing temporary server model: user A can host a local MistV server and advertise a reachable [IPv6]:PORT; users B/C/D/E can connect when that TCP port is allowed by the OS/router firewall. It does not claim MistV can bypass a firewall that blocks inbound TCP.

During local exploration, a 3-5 client encrypted direct-JOIN integration harness exposed unstable group-key convergence unrelated to IPv6 socket/binding behavior, so this PR keeps encrypted IPv6 regression coverage at the existing stable two-client level. That should be tracked separately if reproduced during manual multi-user testing.

Validation

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all --all-features --locked

Note: full tests were run outside the local filesystem sandbox because IPv6 loopback binding can fail inside the sandbox with Operation not permitted.