Fix post-rekey jitter spikes from drain-window frames

After rekey cutover, frames encrypted with the old session can still
arrive during the 10s drain window. These carry large sender timestamps
from the old session, producing enormous transit deltas that spike the
EWMA jitter estimator (observed 2,000-7,000ms spikes on UDP links).

Add a time-based grace period (DRAIN_WINDOW_SECS + 5s = 15s) after
rekey that suppresses jitter updates until drain-window frames have
flushed. Baselines still update every frame so calculation resumes
cleanly after grace expires.

Fixes #10

src/node/session.rs

@@ -5,6 +5,8 @@
 //! (SessionSetup/SessionAck/SessionMsg3) carried inside SessionDatagram
 //! envelopes through the mesh.
 
+use std::time::Instant;
+
 use crate::config::SessionMmpConfig;
 use crate::mmp::MmpSessionState;
 use crate::noise::{HandshakeState, NoiseSession};
@@ -425,8 +427,9 @@ impl SessionEntry {
         self.rekey_completed_ms = 0;
 
         // Reset MMP counters to avoid metric discontinuity
+        let now = Instant::now();
         if let Some(mmp) = &mut self.mmp {
-            mmp.reset_for_rekey();
+            mmp.reset_for_rekey(now);
         }
         true
     }
@@ -452,8 +455,9 @@ impl SessionEntry {
         self.rekey_initiator = false;
 
         // Reset MMP counters to avoid metric discontinuity
+        let now = Instant::now();
         if let Some(mmp) = &mut self.mmp {
-            mmp.reset_for_rekey();
+            mmp.reset_for_rekey(now);
         }
         true
     }