feat: add configurable liveness timing with safe deadlines

[NicolasDP]

Summary

• add a validated, endpoint-wide TimingProfile for established-session
  passive keepalive and dead-peer timing
• preserve the exact v1 defaults (10s keepalive / 25s dead timeout) and
  stamp the profile onto both outbound and inbound connection birth paths
• validate the coupled timing margin
  (D_eff > 2 * K_eff + K_INITIAL_RTT + 2 * SHELL_LATENESS_BOUND) and make
  persistent-keepalive validation use the connection's effective dead timeout
• make monotonic deadline arithmetic checked end to end across endpoint,
  connection, recovery, close, ACK, guard/introduction, and test-util timers
• represent deadlines beyond the platform clock horizon as logically enabled
  but unannounced, so they cannot panic, wrap, clamp, saturate, or fire early;
  later state transitions recompute them
• document rulings 282-284 and add independent public, flow, and near-horizon
  regression coverage

Compatibility

• no wire-format, handshake, cryptography, or negotiation changes
• existing applications retain the exact v1 timing behavior unless they
  explicitly install a custom profile
• asymmetric profiles remain wire-compatible, although peers may reach local
  liveness verdicts at different times
• all non-liveness protocol timers remain fixed

Verification

• cargo fmt --all -- --check
• cargo check --all-targets --all-features
• cargo build --all-features --all-targets
• cargo clippy --all-targets --all-features -- -D warnings
• RUSTDOCFLAGS="-D warnings" cargo doc --no-deps
• RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features
• cargo test
• cargo test --all-features
• cargo test --release --all-features
• cargo +1.96.0 check --all-features --all-targets
• cargo deny check
• git diff --check

All gates pass. cargo deny reports only the pre-existing non-failing
duplicate-syn and unmatched license-allowance warnings.