v0.14.0

The daemon now emits the last three documented WS `error` codes whose conditions it detected but never signaled. **With this, every PROTOCOL.md §3.10 error code is real — the protocol doc↔impl drift (bug #4) is fully closed.**

## Added — error-signaling
- **`rtp_timeout`** — when the media inactivity watchdog fires (no inbound RTP for `[media].inactivity_timeout_secs`), the WS server is now told *why* (`error{rtp_timeout}` + `stop`) before the socket closes, instead of seeing a bare close.
- **`audio_format`** — inbound binary frames are validated against the negotiated frame size (320 B @ 8 kHz, 640 B @ 16 kHz). A wrong-size frame is **dropped** (non-fatal) and reported via `error{audio_format}`, **rate-limited** to the first bad frame + at most one/sec. The call stays up — one malformed frame can't kill it; persistent failure is still caught by the dead-air / rtp watchdog.
- **`protocol_error`** — malformed JSON, an unknown message `type`, or a `call_id` that doesn't match the connection now emits `error{protocol_error}` + `stop` before closing.

## Behavior change
`protocol_error` is a **definitive** teardown (new `DisconnectReason::ProtocolError`) — **not** reconnect-eligible, since a buggy server would just repeat the violation. Previously these conditions tore down silently *and* were reconnect-eligible.

Minor bump. Protocol stays **v1**.

PRs: #223, #224. Closes bug #4 (steps 1–3: v0.13.0 + v0.14.0).