doctor: deepen DC verification with MTProto handshake probe

[dolonet]

Closes #494.

Stacked on top of #495 — keeping this as a draft until #495 merges, then I'll rebase to drop the obfuscation rename commit and leave only the two commits unique to this work. The diff currently shows 3 commits because of that.

What this does

After a successful TCP connect, mtg doctor performs an unauthenticated req_pq_multi → resPQ exchange against each DC. This proves the peer can speak MTProto, not just bind on port 443.

• mtglib/dcprobe — new leaf package, ~170 LOC, no new dependencies. Reuses the now-public mtglib/obfuscation (mtglib: promote obfuscation out of internal #495). Single round-trip, two TL messages, hand-rolled (de)serialization to avoid pulling in gotd/td or similar.
• Doctor.checkNetworkAddresses — the dial loop now runs the probe and surfaces rpc <rtt> next to the connect line.
• Failure messages distinguish tcp connect to <addr>: … from rpc handshake to <addr>: … via wrapped errors. errors.Is(err, dcprobe.ErrNotTelegram) lets callers tell the cases apart.

The probe is enabled by default — an opt-in --deep flag would defeat the purpose, since the existing TCP-only check is what motivated the issue. Open to a flag if you'd rather have a soft rollout.

Output sample

Verified locally on a Hetzner Helsinki host with a real config:

Validate native network connectivity
  ✅ DC 1 (rpc 144ms)
  ✅ DC 2 (rpc 42ms)
  ✅ DC 3 (rpc 130ms)
  ✅ DC 4 (rpc 27ms)
  ✅ DC 5 (rpc 185ms)

Tests

• mtglib/dcprobe/probe_test.go ships two tests:
  • TestProbeRejectsMisbehavingPeer — deterministic, in-process, no network. Spins up a localhost listener that accepts the obfs2 handshake then writes garbage; asserts errors.Is(err, dcprobe.ErrNotTelegram).
  • TestProbeAgainstTelegramDCs — opt-in via MTG_PROBE_NETWORK=1, hits all 5 main DCs + 2 IPv6 DCs. Skipped by default to keep CI hermetic; matches the existing pattern for the obfuscation fuzz tests.
• go build ./..., go vet ./..., go test ./... all clean.

Notes

• I picked the failure-mode of "TCP ok but RPC failed" returns the same red ❌ as TCP failure — the wrapped error message tells you which it was. Happy to add a separate ⚠️ template if you'd like a softer signal there.
• DC numbers are now passed into checkNetworkAddresses so the probe knows which DC to bake into the obfs2 handshake frame; previously the function only needed the address list.