NAT: Full Cone (EIM) NAT with ETCP_ID_NAT protocol, per-node routing, and comprehensive test suite

- New ETCP protocol ETCP_ID_NAT (0x02) for NAT traffic between nodes
- eim_nat.c/h: Pure NAT engine (table, port allocation, checksum updates, egress/ingress)
- nat_transport.c/h: Transport layer (NAT TUN, ETCP binding, client/provider roles)
- route_bgp_find_conn_for_node(): shared utility for optimal connection lookup
- tun_init_nat(): dedicated TUN creation for NAT
- Config: [nat] section with tun_ip, port_start/end, nat_via, forward rules
- Fix: csum_update_ip/transport use htonl() halves (correct on LE systems)
- Fix: IP_FRAG_MF_MASK changed to 0x2000 (after ntohs, MF is bit 13)
- Tests: 26 engine unit + 4 transport integration + 7 stress (29 total)

src/config_parser.h

@@ -121,6 +121,22 @@ struct global_config {
     struct CFG_ALLOWED_KEY *allowed_keys;
     int allowed_keys_count;
     int allowed_keys_allow_all;
+
+    // NAT configuration ([nat] section)
+    int nat_enabled;
+    char nat_tun_ifname[16];
+    struct IP nat_tun_ip;
+    uint64_t nat_via_node_id;     // 0 = this node is provider; !=0 = client, use this provider
+    uint16_t nat_port_start;
+    uint16_t nat_port_end;
+    #define MAX_NAT_FORWARDS 64
+    struct {
+        uint8_t  proto;
+        uint32_t internal_ip_host;
+        uint16_t internal_port_net;
+        uint16_t external_port;
+    } nat_forwards[MAX_NAT_FORWARDS];
+    int nat_forward_count;
 };
 
 struct utun_config {