[tintinhamans]

Merge after #659. Conflicts with #625 in OnlineServices_Init.h; this branch gets rebased once #625 lands.

The connection handshake carries the identity of the peer as plain text the peer wrote itself, a signal from the service was answered whatever user it claimed to be, and a command was accepted from any peer whatever author it named. The router also forwards other players' frames and chat, so a peer could alter what it passed on unnoticed.

The peer that finishes a handshake must now be the user the connection was made for, and a signal is only answered for the user the service stamped it with (WebSocket::PendingSignal carries senderUserID). A command whose author is not the sender is rejected unless the router relays it. Each client makes an Ed25519 key pair when it joins or creates a lobby (MatchKeys, new) and announces the public key over each peer's own connection on a new key channel. A player signs its own frame info and chat, and a frame or chat passed on for another player is only accepted with that player's signature (frames wait up to 3 s for it). The leave notice gets a signature field for the disconnect PR.

The host does not start while a member is not connected or has not exchanged keys, and the chat says who it waits for. Each client checks again before gameplay and leaves instead of starting unauthenticated. The anticheat plugin transport has no keys, and the launch logs that.

Wire change: new command types NETCOMMANDTYPE_SIGNEDFRAMEINFO and NETCOMMANDTYPE_SIGNATURES, key channel messages, and DISCONNECTPLAYER grows by 65 bytes outside retail compatible mode. No new service key. Conflicts with #625 on the PendingSignal queue type.

Tested: builds x86 Release z_generals. In the 3 player rig (full stack) the host held a late joiner's start until keys were exchanged, 0 CRC mismatches, n=1.