finalise docs: accurate header size, PING/PONG, build instructions, repo layout

README:
- Fix header size (8 bytes, not 6) and payload_len field
- Mark client as built (not 'planned')
- Add PING/PONG to protocol summary
- Add client usage section (Discover, mirror ports, Test button, tray)
- Add building from source section (Rust + .NET)
- Add Npcap prerequisite explanation
- Add Windows privilege/UAC note
- Add full repository layout tree

PROTOCOL:
- Fix MANIFEST payload description in frame types table (hostname + entries)
- Add PING/PONG flow diagram and semantics section

PROTOCOL.md

@@ -40,7 +40,7 @@ emitted in v1.
 | Type | Name        | Direction     | session_id | Payload                          |
 |------|-------------|---------------|------------|----------------------------------|
 | 0x01 | DISCOVER    | C → broadcast | 0          | empty                            |
-| 0x02 | MANIFEST    | S → C         | 0          | `id:1, proto:1, port:2` × N      |
+| 0x02 | MANIFEST    | S → C         | 0          | `hostname_len:1, hostname:N, entries...` |
 | 0x03 | OPEN        | C → S         | 0          | `upstream_id:1`                  |
 | 0x04 | OPEN_ACK    | S → C         | assigned   | `upstream_id:1`                  |
 | 0x05 | OPEN_NAK    | S → C         | 0          | `upstream_id:1, reason:1`        |
@@ -212,3 +212,26 @@ client                            server
   it emits `CLOSE` and exits.
 - The server's tunnel→socket path writes `DATA` payloads to the `TcpStream`
   with `write_all`. On error it emits `CLOSE` and drops the session.
+
+## Network test (PING/PONG)
+
+```
+client                            server
+  |                                 |
+  | PING { nonce }                  |
+  |-------------------------------->|
+  |                                 |
+  |        PONG { nonce }           |
+  |<--------------------------------|
+  |                                 |
+  | (repeated at random intervals)  |
+  |                                 |
+```
+
+- The client sends `PING` frames at random 10–100 ms intervals, each with a
+  unique `nonce`.
+- The server echoes the nonce verbatim in a `PONG` frame.
+- The client correlates `PONG` nonces with outstanding `PING` timestamps to
+  compute RTT, average latency, jitter (mean absolute delta of consecutive
+  RTTs), and drop rate (unanswered PINGs).
+- PING/PONG frames use `session_id = 0`; they are independent of TCP sessions.