WebRTC ICE-candidate coherence

Tests (browser-zone fingerprint / exit coherence — diagnostic, not a harm row). Opens an RTCPeerConnection against a public STUN server and enumerates the ICE candidates the browser discloses. The srflx (server-reflexive) address is the public IP a STUN server sees — compare it to the claimed residential exit IP. The host candidates leak whatever private/mDNS address the browser is bound to. Caveat: a vendor-hosted CDP browser runs in the vendor's container, so host candidates reveal the container's topology, not the endpoint owner's home LAN — this is an exit-coherence / fingerprint diagnostic, not a LAN-recon vector.

Driven over CDP: a probe navigates here, waits for document.title to start with ICE-DONE (or ICE-TIMEOUT), then reads the JSON in #result.

gathering…