MeshCore bearer: end-to-end reliability over the flood (#26)

[M0LTE]

End-to-end reliability (#26) for the MeshCore bearer. The channel is a fire-and-forget flood with no link ACK, so DAPPS adds its own — datagram-style, not a session (no handshake, no window, no ordered stream).

How it works

• The receiver ACKs any data message addressed to it (a tiny mc-ack control broadcast).
• The sender tracks unacked messages and resends on exponential backoff until acked or its lifetime (min(TTL, 5 min)) expires.
• The receiver dedups by message id, so a resend after a lost ACK is delivered to the app once (idempotent).
• Resends/ACKs are ordinary channel traffic — governor + adaptive controls apply.
• Config: DAPPS_MESHCORE_RELIABLE_DELIVERY (default true).

Adversarial-review fixes folded in

• Idempotency was actually missing — DAPPS's inbox flood-dedup is gated on FloodHopsRemaining, which these messages don't carry, so resends were double-delivering. Added an explicit receiver-side delivered-ids dedup.
• Resends no longer burn backoff slots when refused by congestion/budget (DueResends peeks; MarkResent advances only on a real send).
• TxBudget refund is token-based (concurrent sends can't refund each other's reservations); ToFrames nonce made thread-safe (now called concurrently by OMM send + resend loop + inbound ACKs).
• Transport _compressed map no longer leaks for incomplete reassemblies.
• ACKs consumed unconditionally; failed ACK sends logged.

Validation

• 21 MeshCore unit tests; full solution builds clean.
• On-air soak (two Heltec V3s, 40% induced loss): delivered == distinct (no duplicate app delivery), lost messages recovered by resend+ACK, nothing expired.

Builds on #162. Inert unless MeshCoreEnabled=true.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KLbwvhE2cKCe8WPZNg8k17