Add Frame coalesce limit

[heshaoqiong-tuya]

What

Small transport frames now go out as a single write. A frame whose whole wire
size — frame header + app header + payload + signature — is strictly under
TAI_FRAME_COALESCE_LIMIT (new compile-time knob, default 512 B) is gathered
into tx_ctrl_buf and emitted with one ctx_io_send:

scatter path:  [hdr‖app-hdr] [payload] [sig]  →  2–3 tls_write
coalesced:     [hdr‖app-hdr‖payload‖sig]      →  1 tls_write

Ping, every control packet (SessionNew/Close, the Event series, ChatBreak) and
small audio chunks all fall inside the window.

Why

Each ctx_io_send is a locked tls_write plus an mbedtls record build —
tens of microseconds per call. The typical TAI frame is small (Ping ≈ 47 B on
the wire; a 20 ms Opus chunk + header + signature ≈ 200–400 B), so per-write
overhead dominated the send path for exactly the packets sent most often. The
gather is a bounded memmove/memcpy of at most 511 B — noise next to one
saved TLS record.

Design notes

• The scratch buffer IS the control packet. A control packet's payload is
  already tx_ctrl_buf (send_app hands it straight through), so the gather
  relocates the payload to its final offset first (memmove, overlap-safe)
  before the frame header overwrites its front. The frame HMAC is computed
  over the original bytes before any relocation; the in-place shift preserves
  them, so the signature stays valid.
• Zero-length payloads arrive as NULL. Header-only packets (Audio END)
  pass pay = NULL, pay_len = 0; the relocation is length-guarded — glibc
  declares memmove non-NULL and UBSan flags the call even for length 0.
  (Caught by Linux CI: Darwin's string.h carries no non-NULL attributes, so
  this class is invisible to a Mac-hosted UBSan.)
• Two independent knobs. Coalescing is capped at the smaller of
  TAI_FRAME_COALESCE_LIMIT and TAI_TX_CTRL_BUF_SIZE, so a
  memory-constrained build that shrinks the control buffer narrows the
  coalesce window instead of writing past tai_ctx. Defaults stay
  independent (512 / 1024): the coalesce limit is a performance window, the
  control buffer's job is holding the largest control packet (escaped
  session/event JSON + framing) — deriving one from the other would turn a
  performance knob into a capacity knob.
• §6.3 semantics unchanged. Pre-wire failures still return the build
  error with the sequence rolled back; any failure after the first byte on
  the wire returns TAI_ERR_NET with the sequence consumed. For a coalesced
  frame that first byte is the single write.