[tintinhamans]

Merge after #648. Includes #644, closed as folded into this PR.

WebSocket::Tick sent the whole outbound queue and only logged failures, so a partial send or CURLE_AGAIN lost the rest of a frame and the next message went out in the middle of it. The game also talked to a single API host, so a player whose route to it was blocked could not log in.

The send queue now keeps the offset into a partly sent message and is capped, a tick reads up to 64 queued frames, heartbeats no longer pile up, and any send or receive error reconnects. The game tries api.playgenerals.online, then api-ru.playgenerals.online, through the anonymous VersionManifest request (6 s each) and remembers the one that worked. A 401 or 403 stops the search, the route is reused for 30 s, a signed in session keeps its route, and dev and test have one route. Requests and the WSS address stay on the selected route, the token is only sent there, and redirects are no longer followed.

settings.json gets network.server.mode (automatic, the only value here, custom comes with #646) and network.last_route, the host of the last working route. The old use_alternative_endpoint is read once as the api-ru host, and network.http_version is dropped. Invalid values are reset to their default and written back. Unknown keys are kept on save, but data_packs is replaced wholesale by what the client holds, and a settings file that could not be read is no longer overwritten with defaults.

Response bodies, login codes and websocket payloads are only logged with debug.verbose_logging. _DEBUG builds skip TLS verification for local service testing, release always verifies.

No service changes needed. Tested: z_generals builds, route policy checks, a 120 s two client match with 25% TCP loss on the API/WSS port (no reconnect, no send error). Not tested: a real fallback to the alternative route.