Document UDP port-forward support

CLAUDE.md's port_forward.{h,cpp} entry, README.md's -p table row, and
docs/networking-design.md's syntax line all updated for the new
[/tcp|udp] suffix. Includes the local dev-machine (root, via the scoped
doas rule) verification detail: TCP unaffected, UDP confirmed end-to-end
(a raw datagram sent to the forwarded host port was read back inside the
container via -x/--exec), same port pair coexisting on both protocols,
invalid-protocol parse errors, clean teardown, and --clean-processes
sweeping both the old 3-field and new 4-field state-file formats. Real
Android iptables/tetherctrl_FORWARD confirmation for UDP is still open.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv3s5jckJKzh6JkMoi2Akz

docs/networking-design.md

@@ -101,10 +101,16 @@ No `slirp4netns` `hostfwd` API to lean on, so this is implemented directly:
   otherwise silently eat the forwarded traffic, the same gap Docker itself
   works around.
 
-Syntax: `-p [<network>:]<host-port>:<container-port>`. `<network>` is
-optional — when omitted, resolves to whichever single extern network the
+Syntax: `-p [<network>:]<host-port>:<container-port>[/tcp|udp]`. `<network>`
+is optional — when omitted, resolves to whichever single extern network the
 container joined; an error (not a silent guess) if the container joined more
-than one extern network and didn't disambiguate.
+than one extern network and didn't disambiguate. The protocol suffix is
+optional too, defaulting to `tcp`; both the `DNAT` and `FORWARD ACCEPT`
+rules above use whichever protocol was resolved, so a UDP forward gets the
+exact same treatment as TCP, just with `-p udp` instead of `-p tcp` on both
+— the same port pair can be forwarded once per protocol (e.g.
+`-p 53:53/tcp -p 53:53/udp` for a DNS-like service), since neither rule set
+collides with the other.
 
 ## DNS resolution