ecn: CE-mark on decap when the receive queue runs deep (nebula-as-AQM)

The tunnel's real bottleneck queue - the UDP receive buffer feeding the
decrypt loop - is invisible to every kernel AQM, so under overload it
regulates ECN-capable flows with tail-drop loss like it's 1993. Sample
SK_MEMINFO once per recvmmsg batch (tunnels.ecn_mark_threshold, fraction
of rcvbuf, 0=off) and treat depth beyond the threshold as an outer CE:
the existing RFC 6040 fold then CE-marks ECT inner packets and senders
back off without loss.

udp/conn.go

@@ -24,6 +24,13 @@ const MaxWriteBatch = 128
 // supply on every packet.
 type RxMeta struct {
 	OuterECN byte
+	// QueueCongested is set when the receiving socket's kernel queue depth
+	// exceeded the configured AQM marking threshold (tunnels.ecn_mark_threshold)
+	// when this batch was pulled. The decap path treats it like an outer CE
+	// mark on ECT inner packets — nebula acting as the AQM for the one queue
+	// on the tunnel path no kernel AQM can see. Backends without queue
+	// introspection leave it false.
+	QueueCongested bool
 }
 
 type EncReader func(