feat(network): add selectable privacy-preserving discovery

docs/DEVELOPMENT.md

@@ -38,11 +38,15 @@ node names, connect persistent and networked state to that data.
 network services validate and replicate bounded domains such as fishing,
 sales, shops, item use, profiles, jobs, mail, chat, drawings, time, and weather.
 
-`DiscoveryClient` is an optional directory layer beside `NetworkSession`. An
-open host may publish a short-lived room lease, and the shared Join Game page
-may browse compatible leases before handing the selected address back to the
-existing direct ENet connection flow. The directory does not carry gameplay
-traffic or become a gameplay authority. Its base URL comes from
+`DiscoveryClient` is an optional directory layer beside `NetworkSession`. A
+player host cycles its discovery control through `private`, `direct`, and
+`relay`. Private leaves the room unlisted, direct discovery discloses the host
+route only after an explicit Join, and relay discovery allocates a UDP privacy
+route without making discovery a gameplay authority. Relay joins fail closed
+and never silently downgrade to direct. Dedicated servers are always direct:
+the game forces direct advertisements and discovery independently rejects a
+dedicated relay request. Public room browsing never receives a host address.
+The base URL comes from
 `network/discovery/base_url`, with `straywild_DISCOVERY_URL` available as a
 development/deployment override.
 
@@ -53,8 +57,9 @@ friendship; unblocking does not recreate it. Discovery may publish opt-in,
 short-lived friend presence and deliver invitations only while both games are
 online. It stores hashed capability identifiers rather than identity
 fingerprints or a complete friend graph, keeps no durable social records, and
-provides no offline delivery. Direct joins still use the existing verified
-public-room and ENet connection path.
+provides no offline delivery. Public joins still use the existing verified
+server-identity and ENet connection path. Discovery endpoints remain transient:
+they are not shown, added to recent servers, or persisted in the trust store.
 
 The host is authoritative. Clients submit requests or evidence; the host
 derives trusted context from registered peers, authoritative regions, and

docs/README-PLAYTEST.txt

@@ -1,13 +1,18 @@
 straywild
-v0.20.2-alpha
-Alpha 0.20.2
+v0.20.3-alpha
+Alpha 0.20.3
 
 Thank you for supporting this private testing release.
 
 straywild is an early multiplayer fishing game. This alpha includes local
 progression, player-hosted and dedicated multiplayer sessions, public room
-discovery, and direct UDP connections. Expect rough edges and please keep a
-backup of any save or identity data you care about.
+discovery, player-selected direct or privacy-relayed hosting, and optional
+direct UDP connections. Player hosts can cycle discovery through private,
+direct, and relay. Dedicated servers are always direct and cannot use the
+shared relay. The relay hides peers' addresses from one another but not from
+the relay operator. Direct connections expose public IP addresses to the
+remote peer and are clearly labeled in game. Expect rough edges and please
+keep a backup of any save or identity data you care about.
 
 INSTALLATION
 
@@ -115,8 +120,9 @@ Please include:
 
 KNOWN ALPHA LIMITATIONS
 
-- Public sessions remain direct connections; restrictive NAT or carrier-grade
-  networks may prevent some players from joining.
+- Direct public sessions may fail behind restrictive NAT or carrier-grade
+  networks. Player-hosted relay sessions add an extra network hop and may have
+  more latency. Dedicated servers are direct-only.
 - Multiplayer, dedicated-server deployment, UI, and balance are still alpha.
 - Some fish and character artwork remains temporary.
 - RV exteriors and decor use temporary prototype geometry and presentation.