feat: harden engine config, discovery and backpressure stats

- config: validate port/quality/fps/source/stream-index ranges on load
  and before engine start (flinger.Config.Validate)
- discovery: add Announce option to disable multicast (GUI checkbox,
  CLI --no-announce); absent JSON key keeps the default true
- backpressure: count dropped frames in the TCP sender, expose via
  engine Status and a live counter in the GUI status label
- docs: record M3/M4 decisions and X11 coverage via the portal backend

internal/flinger/flinger_test.go

@@ -11,7 +11,7 @@ import (
 func TestEnginePatternStartStop(t *testing.T) {
 	cfg := DefaultConfig()
 	cfg.Source = "pattern"
-	cfg.Port = 0 // ephemeral
+	cfg.Port = 19756 // fixed high port for the test
 
 	eng, err := New(cfg)
 	if err != nil {
@@ -77,6 +77,29 @@ func TestNewRejectsBadSource(t *testing.T) {
 	}
 }
 
+// TestValidate rejects out-of-range values.
+func TestValidate(t *testing.T) {
+	bad := []func(*Config){
+		func(c *Config) { c.Port = 0 },
+		func(c *Config) { c.Port = 70000 },
+		func(c *Config) { c.Quality = 0 },
+		func(c *Config) { c.Quality = 101 },
+		func(c *Config) { c.FPS = 0 },
+		func(c *Config) { c.StreamIndex = -1 },
+	}
+	for i, mutate := range bad {
+		c := DefaultConfig()
+		mutate(&c)
+		if err := c.Validate(); err == nil {
+			t.Errorf("case %d: expected validation error", i)
+		}
+	}
+
+	if err := DefaultConfig().Validate(); err != nil {
+		t.Errorf("default config should validate: %v", err)
+	}
+}
+
 func itoa(v int) string {
 	if v == 0 {
 		return "0"