ecn: CE-mark on decap when the receive queue runs deep (nebula-as-AQM)

The tunnel's real bottleneck queue - the UDP receive buffer feeding the
decrypt loop - is invisible to every kernel AQM, so under overload it
regulates ECN-capable flows with tail-drop loss like it's 1993. Sample
SK_MEMINFO once per recvmmsg batch (tunnels.ecn_mark_threshold, fraction
of rcvbuf, 0=off) and treat depth beyond the threshold as an outer CE:
the existing RFC 6040 fold then CE-marks ECT inner packets and senders
back off without loss.

examples/config.yml

@@ -425,6 +425,13 @@ logging:
   # the route half of this setting to take effect.
   #ecn: true
 
+  # EXPERIMENTAL, Linux only. ecn_mark_threshold turns nebula into the AQM for its own receive queue — the one
+  # congested hop on a tunnel path that no kernel AQM can see. When the UDP receive queue's depth exceeds this
+  # fraction of the receive buffer (see listen.read_buffer), decapsulated ECT packets are CE-marked so ECN-capable
+  # senders back off before the queue overflows and regulates by tail-drop (loss) instead. 0 disables (default).
+  # Requires `ecn: true` end to end. Sampled once per receive batch. Reloadable.
+  #ecn_mark_threshold: 0.05
+
 # Nebula security group configuration
 firewall:
   # Action to take when a packet is not allowed by the firewall rules.