nx_stun_server_gate.nx

nx_stun_server_gate.nx -- proves the sovereign STUN reflexive responder two ways: PART A (pure): ss_handle reflects a request's source sockaddr into a valid Binding Response whose XOR-MAPPED-ADDRESS decodes back to that source IP:port, with the txid preserved and a self-consistent FINGERPRINT; a non-STUN packet is ignored (returns 0). PART B (LIVE, real UDP sockets): a fork loopback -- child = the server, parent = a client bound to a KNOWN port -- proves end-to-end that a client sending a real Binding Request LEARNS ITS OWN REFLEXIVE ADDRESS (127.0.0.1:<client port>) back from the server. This is srflx discovery working, sovereignly. license_tier: ORIGINAL expect_exit: 0