Add randomized ETCP padding and isolate STCP CTR streams per connection

src/utun_instance.c

@@ -152,6 +152,7 @@ static int instance_init_common(struct UTUN_INSTANCE* instance, struct UASYNC* u
         memcpy(instance->my_ed25519_privkey, ed_priv_hash, SC_PRIVKEY_SIZE);
     }
     DEBUG_INFO(DEBUG_CATEGORY_CRYPTO, "Ed25519 pubkey derived successfully");
+    if (etcp_padding_start(&instance->padding, ua, instance->name) < 0) return -1;
     
     // Initialize networks queue (indexed by 56-bit network id)
     instance->networks = queue_new(ua, 16, offsetof(struct NETWORK_ENTRY, id), 7, "networks");
@@ -328,6 +329,7 @@ struct UTUN_INSTANCE* utun_instance_create(struct UASYNC* ua, const char *config
     // Initialize using common function
     if (instance_init_common(instance, ua, config) != 0) {
         // Cleanup on error
+        etcp_padding_stop(&instance->padding);
         if (instance->config) free_config(instance->config);
         u_free(instance);
         return NULL;
@@ -368,6 +370,7 @@ struct UTUN_INSTANCE* utun_instance_create_from_config(struct UASYNC* ua, struct
     // Initialize using common function (config ownership transferred to instance)
     if (instance_init_common(instance, ua, config) != 0) {
         // Cleanup on error - caller still owns config since we failed
+        etcp_padding_stop(&instance->padding);
         u_free(instance);
         return NULL;
     }
@@ -401,6 +404,7 @@ void utun_instance_destroy(struct UTUN_INSTANCE *instance) {
     if (instance->ua) uasync_print_resources(instance->ua, "INSTANCE_DESTROY_BEFORE");
     
     instance->running = 0;
+    etcp_padding_stop(&instance->padding);
     DEBUG_INFO(DEBUG_CATEGORY_SYS, "[DESTROY] A done — diagnose complete");
 
     /* Phase B: NTP */