Add TURN/STUN end-to-end probes and per-test flags to pam tunnel diagnose

[miroberts]

tunnel_and_connections.py:

• Add --turn-test flag: establishes a real WebRTC/TURN connection through
  the gateway without proxying traffic, reproducing the full ICE path
• Add --stun-only flag: same probe with TURN credentials stripped on both
  sides, restricting ICE to host/srflx candidates; confirms the reflexive
  path works independently of the relay. Mutually exclusive with --turn-test
• Add --probe-duration (default 30s) to hold the connection open; use
  360+ to trigger and verify survival of the ~300s permission refresh cycle
• Add --probe-count for concurrent connection load testing
• Add --stress-test: connection cycling, throughput across 64B–256KB frame
  sizes, and concurrent load; implies --turn-test
• Add --test-dns/--test-aws/--test-tcp/--test-udp/--test-ice/--test-webrtc
  flags as per-test alternatives to the comma-separated --test string;
  both styles can be combined and are merged into a single validated set
• Add _yellow() color helper for diagnostic output
• Section header, connect label, hold message, throughput, and stability
  labels all adapt to STUN vs TURN mode

tunnel_helpers.py:

• Add probe_stun_only param to start_rust_tunnel: strips turn_url,
  turn_username, turn_password from webrtc_settings so Commander's ICE
  agent gathers no relay candidates; sends stun_only=True to gateway
• Add turn.client.relay_conn to webrtc crate suppression lists so the
  periodic "fail to refresh permissions" error no longer leaks to terminal
• Add NullHandler to all loggers configured with propagate=False; without
  a handler Python's lastResort StreamHandler fires when callHandlers()
  finds found=0, bypassing propagate=False