feat: WebSocket / Secure WebSocket / WebRTC transports

## Why

Browser peers (js-libp2p in the browser, the bulk of consumer wallets) **cannot use raw TCP or QUIC** because browsers don't expose those APIs to JS. Every libp2p-in-browser peer reaches the network through one of three transports: WebSocket (`/ws`, `/wss`), WebTransport (`/quic-v1/webtransport`), or WebRTC (`/webrtc-direct` and `/webrtc` via signalling).

Tracking: #80

## Sub-features

### WebSocket / Secure WebSocket (`/ws`, `/wss`)

- RFC 6455 framing on top of TCP / TLS
- Multiaddr: `/ip4/N/tcp/N/ws` or `/ip4/N/tcp/N/tls/sni//ws`
- HTTP/1.1 upgrade handshake (`GET / HTTP/1.1\r\nUpgrade: websocket\r\n…`)
- Then carries multistream + Noise + muxer like raw TCP
- Server side: HTTP server that accepts upgrade requests and hands off the upgraded stream

### WebRTC (`/webrtc-direct`)

- Spec: [https://github.com/libp2p/specs/blob/master/webrtc/](https://github.com/libp2p/specs/blob/master/webrtc/)
- Browser-friendly (no signalling server, certificate verification via SDP fingerprint matching the libp2p peer key)
- Pure-Zig implementation is a multi-month effort — DTLS 1.2 + SCTP + ICE; vendoring a Zig WebRTC stack (if one exists) is the realistic path. Otherwise gate behind libc + a C lib (regresses #36 purity claim — discuss before pursuing).

### WebTransport (`/quic-v1/webtransport`)

- Builds on the QUIC stack already in zquic
- Extension on top of HTTP/3 — needs HTTP/3 server framing
- Pure-Zig viable; smaller than WebRTC

## Recommended order

1. **WebSocket + WSS** first — straightforward HTTP upgrade, reuses existing TCP+TLS+Noise+muxer chain. Unblocks js-libp2p browser interop for many testnets.
2. **WebTransport** second — extends QUIC stack already in place.
3. **WebRTC** last — biggest implementation cost, partially overlaps with browser-only use cases.

## Acceptance

- WebSocket round-trip with js-libp2p in a browser tab.
- WSS round-trip behind nginx terminating TLS.

Start with tracking issue #80 and the existing TCP, TLS, Noise, and muxer transport chain described here. For the recommended first phase, investigate the HTTP server upgrade path for WebSocket/WSS before evaluating WebTransport in zquic and the WebRTC specification. Done means a WebSocket round-trip with js-libp2p in a browser and a WSS round-trip behind nginx terminating TLS.

Written by the indexing model from the issue text.