Enforce the TCP receive window to bound per-session memory

[IntellyCode]

ipstack advertises a receive window but never enforces it: the reassembly buffer and the data_tx handoff channel are both unbounded, so a peer that outpaces the reader (or holds a reassembly gap open) grows a session's memory without limit — an OOM risk on memory-constrained hosts.

This makes the window real:

• add_unordered_packet drops out-of-order segments once the reassembly buffer reaches read_buffer_size (head-of-line always admitted).
• data_tx/data_rx are bounded; extract_data_n_write_upstream reserves a slot before consuming, so a stalled reader shrinks the advertised window and backpressures the peer. poll_read signals a Notify to re-drive the flush when space frees.
• SWS avoidance: advertise zero below one MSS, so a full receiver uses the peer's persist mode.
• A FIN is accepted only once ack reaches its sequence, so a full channel can't strand the tail.
• consume_unordered_packets trims a segment a retransmission left straddling ack instead of wedging.

Covered by unit tests and an async test; validated live against a real TCP connection (reader stalled → server throughput drops to zero, recovers on resume, clean close). If you'd prefer an in-repo integration test, I can add ~200 lines to tests/ that build a packet-framed in-memory device and assert the window closes under a stalled reader and reopens on drain.

[SajjadPourali]

I believe this causes some issues with wrap-around after the maximum sequence number ($2^{32} - 1$) is reached.

[IntellyCode]

This does not go through ordinary >.

SeqNum isn't a plain u32. it carries its own Ord.

impl Ord for SeqNum {
    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
        let diff = self.0.wrapping_sub(other.0);
        if diff == 0 { Ordering::Equal }
        else if diff < MAX_DIFF { Ordering::Greater }
        else { Ordering::Less }
    }
}

So this comparison is wrap safe,