proto: webrtc_all_ice — full-ICE offers under transport-forced relay

use_ws() folds into force_relay because a ws tunnel kills classic TCP/UDP
punching — but ICE opens its own sockets and does not care how signaling
reaches the server. Without a signal, the controlled side must treat every
force_relay offer as Relay-only ICE (answer gated on TURN), which locks
WebSocket deployments out of direct WebRTC entirely.

webrtc_all_ice marks an offer that gathered every candidate type: the
controller's force_relay covers only classic punching, not ICE policy.
Absent/false keeps today's semantics on every skew combination (old
controller, old server dropping the field, old controlled side).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ExUfAkYbq8UC9pQCiLy8TQ

protos/rendezvous.proto

@@ -30,6 +30,12 @@ message PunchHoleRequest {
   bytes socket_addr_v6 = 10;
   string switch_code = 11;
   string webrtc_sdp_offer = 12;
+  // The attached offer gathers every ICE candidate type (host/srflx/relay), so a direct
+  // WebRTC path may form even when force_relay is set. Sent by clients whose force_relay
+  // stems from the transport (WebSocket tunnels only the signaling/relay legs and kills
+  // classic punching, not ICE) rather than from relay-by-policy; absent/false keeps the
+  // old semantics where force_relay implies a Relay-only-ICE offer.
+  bool webrtc_all_ice = 13;
 }
 
 message ControlPermissions {
@@ -66,6 +72,9 @@ message PunchHole {
   ControlPermissions control_permissions = 8;
   ControlledContext controlled_context = 9;
   string webrtc_sdp_offer = 10;
+  // Forwarded from PunchHoleRequest.webrtc_all_ice; see that field. Tag 11 previously
+  // carried the never-shipped `requester_id` (added and removed in one unshipped batch).
+  bool webrtc_all_ice = 11;
 }
 
 message TestNatRequest {