[tintinhamans]

Merge after #661.

A leaving player could be removed on different frames on different machines, a graceful quit waited out the whole timeout like a dead connection, a leave notice about any slot was trusted from any peer, and the log lines of a dead connection were not limited.

DisconnectManager now removes a player on the same frame everywhere. The acting packet router decides the removal and carries the frame, and everyone that got a leave from the leaver tells the others, so all pick the same next router. Frames of the removed player that others still miss can be asked for again. A peer that closes its connection on purpose during a match is treated as left and removed without waiting for the timeout. That is read from the GNS end debug string, which is fragile if its wording changes. Slots outside 0 <= slot < MAX_SLOTS are rejected. A leave notice is trusted from the leaver itself or with the leaver's match key signature, and DISCONNECTPLAYER is applied only from the acting router.

Two keys are new: disconnect.freeze_before_screen_ms (5000) is how long a player is stuck before the disconnect screen comes up, disconnect.remove_after_ms (60000) how long a silent player stays on it. [DISC] Recv Failed and "connection is invalid" are limited to once per 5 s per connection, send failures to once per second, and a packet is dropped after 3 failed retries.

A leaver without a match key yet sends an unsigned notice, so the others fall back to the timeout and vote. The signature does not cover the frame, so a captured notice can be replayed in the same match. No wire change here, the signature field comes from the identity PR.

Tested: builds x86 Release z_generals. In the 3 player rig (full stack) both survivors removed the killed host on the same frame, 0 CRC mismatches, n=1.