feat: add UDP NAT rendezvous

README.md

@@ -4,8 +4,9 @@ An ephemeral public-room directory for NETfishing. It complements the game's exi
 transport: hosts advertise a room through HTTPS, browsers retrieve compatible rooms, and joining
 still uses the authoritative host's UDP endpoint.
 
-This first phase intentionally does not use coturn. TURN relays WebRTC traffic; NETfishing currently
-uses ENet/UDP, so NAT traversal and relay transport are a separate future phase.
+The service also runs a small UDP rendezvous. It observes packets sent from the exact ENet sockets
+used by hosts and joiners, then lets an authenticated room host retrieve pending endpoints and send
+hole-punch packets. Gameplay remains direct and never passes through this service.
 
 ## Requirements
 
@@ -41,6 +42,7 @@ The intended public topology is:
 
 ```text
 NETfishing client -> HTTPS reverse proxy -> 127.0.0.1:7770 discovery service
+NETfishing client -----------------------> public UDP rendezvous:7771
 NETfishing client -----------------------> advertised ENet/UDP host:port
 ```
 
@@ -60,11 +62,10 @@ database, backups, or schema migrations.
 
 ## Connectivity boundary
 
-Discovery makes a room findable; it does not make an unreachable ENet host
-reachable. A host still needs its advertised UDP port forwarded/reachable from
-the Internet. The existing coturn service cannot relay ENet packets because
-TURN is a WebRTC transport component. NAT traversal or relay support therefore
-remains a separate transport project and is not hidden inside the directory.
+The game first requests UPnP forwarding, then uses same-socket UDP rendezvous and hole punching.
+This covers common home NAT configurations without changing ENet gameplay authority. Symmetric
+NAT and some carrier-grade networks can still require a future ENet-compatible relay fallback.
+Expose the configured traversal port over UDP in both the host firewall and provider firewall.
 
 ## API