feat(protocol): a box is told what it may spend on video, and the receiver can say what it got

Three additions, all of them plumbing for a bitrate that something
actually decides.

`BootDescriptor` gains `VideoLimits`. It rides the boot document rather
than a kernel command line because `nesinit` handles `Boot` by mounting
and *then* bringing the stack up, so the value is in hand before `neshub`
is spawned -- no parsing, no window where the service is running without
its configuration. It is on the descriptor rather than a launch because
its consumer is a service that comes up with the box; geometry went the
other way for the same reason, its consumer being started per launch.

`bitrate_kbps` is an `Option` and the distinction is load-bearing.
"Nobody said" is not zero and is not unlimited, and a reader that
conflates the first with the last reproduces the bug exactly: every
session offered 10 Mbps because no number had ever been chosen and the
encoder's own default stood in for one. `neshub` now says which it got,
and falls back to something modest rather than to whatever it finds.

Note what `deny_unknown_fields` means here, since it is deliberate: a
host that sends `video` to a guest too old to know the field is refused
rather than quietly served. That is the right direction to fail -- the
alternative is a box that boots, streams, and ignores its ceiling -- and
it means the guest image is rebuilt before a host starts sending one.

`MSG_RECEIVER_REPORT` carries what a second looked like from the far
end: goodput actually released to the decoder, frames released,
incomplete and never-arrived, and the receiver's own RTT. The hub cannot
work any of this out for itself. Its own view was measured saying the
path was healthy while almost nothing was arriving, and one reason is
structural -- `send_datagram` evicts the oldest queued datagrams and
returns `Ok`, so the send side has no backpressure signal at all.

`MSG_CONTROL_MODE` says who is choosing the bitrate. Manual exists
because it is how this class of bug gets found: the original report said
the bitrate had already been lowered, and the only way anyone
established otherwise was by setting one by hand and watching the
picture come back.

Both decoders refuse what they cannot read rather than guessing.
`loss()` returns `None` for a second that accounted for no frames at
all, because a second with nothing sent and a second with nothing
arriving are indistinguishable from there, and answering either 0% or
100% would tell a controller something nobody knows.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/neshub/src/main.rs

@@ -73,6 +73,16 @@ struct Args {
     #[arg(long, env = "NESTRI_AUDIO_BITRATE", default_value_t = 64)]
     audio_bitrate_per_channel: u32,
 
+    /// Ceiling on the video bitrate, in kbps.
+    ///
+    /// Set by `nesinit` from the boot descriptor's video limits, which come
+    /// from the tier the box was sized for. Absent means nobody said -- which is
+    /// not a licence to send whatever the encoder defaults to, since that is
+    /// precisely how every session came to offer 10 Mbps regardless of what the
+    /// path could carry. Unset is reported, and a conservative ceiling is used.
+    #[arg(long, env = "NESTRI_MAX_BITRATE")]
+    max_bitrate_kbps: Option<u32>,
+
     /// Socket nescope sends screenshots on. neshub listens; nescope dials out.
     #[arg(
         long,
@@ -82,6 +92,14 @@ struct Args {
     screenshot_ipc: PathBuf,
 }
 
+/// What to assume when nobody said.
+///
+/// Deliberately modest. A ceiling that was never set should not behave like an
+/// unlimited one: the whole failure this exists to fix was a session offering
+/// 10 Mbps into a path carrying under three, because no number had ever been
+/// chosen and the encoder's own default stood in for one.
+const DEFAULT_MAX_BITRATE_KBPS: u32 = 4_000;
+
 #[tokio::main]
 async fn main() -> Result<()> {
     tracing_subscriber::fmt()
@@ -117,6 +135,15 @@ async fn main() -> Result<()> {
         }
     }
 
+    match args.max_bitrate_kbps {
+        Some(kbps) => tracing::info!("video ceiling: {kbps} kbps, from the boot descriptor"),
+        None => tracing::warn!(
+            "no video ceiling on the boot descriptor; using {DEFAULT_MAX_BITRATE_KBPS} kbps. \
+             A box sized by a tier is told its ceiling -- if this is one, the descriptor did \
+             not carry it."
+        ),
+    }
+
     let endpoint = builder.bind().await?;
     let endpoint_addr = endpoint.addr();
     let ep_id = endpoint_addr.id;