v0.3: 6-layer architecture complete

Layers:
  Layer 1: XDP/eBPF — TCP state machine, SYN throttle, blacklist, ringbuf
  Layer 2: PoW Challenge — SHA-256 hashcash, dynamic difficulty, constant-time verify
  Layer 3: Rust Core — HMAC handshake, rate limit, death code (existing)
  Layer 4: Velocity — Physics check, CAPTCHA, protocol verification
  Layer 5: Paper — Heartbeat, auto-registration (existing)
  Layer 6: Traffic Intel — EWMA, 168h profiling, reputation, alerts

Infra: XDP→Prometheus metrics, ClickHouse + Grafana dashboard, Docker Compose
Testing: 100-IP DDoS simulation, MHDDoS ref analysis, load test report
Fixes: VarInt sign extension UB, pure ACK deadlock, RST/FIN cleanup
Ref: MHDDoS, Sonar, LimboFilter, AtomGuard, Infrarust, MC-XDP-eBPF, PowGo

xdp/config.h

@@ -0,0 +1,31 @@
+#ifndef RAMPART_CONFIG_H
+#define RAMPART_CONFIG_H
+
+// ⚙️ Runtime configurable globals (patched by Rust loader)
+// These are volatile const — compiler replaces reads with immediate values
+// after loader writes to .rodata section
+
+// ── Port range ──
+static volatile const __u16 G_START_PORT = 25565;
+static volatile const __u16 G_END_PORT   = 25570;
+
+// ── SYN throttle ──
+static volatile const __u32 G_SYN_HIT_COUNT      = 10;    // max SYNs / window
+static volatile const __u64 G_SYN_WINDOW_NS       = 3000000000ULL; // 3 sec
+static volatile const __u64 G_SYN_BAN_DURATION_NS = 60000000000ULL; // 60 sec
+
+// ── Idle timeouts ──
+static volatile const __u64 G_CONNTRACK_IDLE_NS   = 30000000000ULL; // 30 sec
+static volatile const __u64 G_PLAYER_IDLE_NS      = 120000000000ULL; // 120 sec
+
+// ── Blacklist default ban duration ──
+static volatile const __u64 G_BAN_DURATION_NS     = 300000000000ULL; // 5 min
+
+// ── Max out-of-order packets before dropping connection ──
+static volatile const __u8 G_MAX_OUT_OF_ORDER = 4;
+
+// ── Feature flags ──
+static volatile const __u8 G_FEATURE_SYN_THROTTLE  = 1;
+static volatile const __u8 G_FEATURE_EVENTS        = 1;
+
+#endif /* RAMPART_CONFIG_H */