me-web? 0.5: the shared exit measured, the route from the server, the network's upstreams

- Behind your provider's shared address, me-web? now shows how its exit hands out ports
  (kept, one after another, from one block, or at random), the range it gave this device,
  and how many customers may share the address at most; the estimate sharpens with each
  check on the same address.
- It tests whether two devices behind the same address can reach each other (hairpin), and
  how long an unused connection stays open: the card says "measuring" for about two minutes
  after the check, then the answer.
- With the test from outside, the publisher's server also traces the route back to your
  address: your provider's routers and the networks in between appear on the path, with
  their names.
- The provider card says which networks your provider reaches the internet through.
- On mobile data, the path shows the operator and the type of network (5G, 4G) read from the
  phone; on Android 13 and later the phone asks once for permission to read the network type.
- The speed card adds the round trip to the publisher's server.
- The network data now comes from the publisher's server, refreshed there from open sources:
  iptoasn.com, DB-IP Lite (CC BY 4.0), the University of Oregon Route Views Project (CC BY 4.0)
  and the Android Open Source Project's list of mobile operators (Apache 2.0); the release
  notes list each source's date and checksum.
- Source links in the cards wrap instead of being cut off.
- New strings, drafted in every language.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

CLAUDE.md

@@ -67,7 +67,8 @@ The Android release key: alias `meweb`, certificate SHA-256
 | `src/MeWeb.Server` | `meweb.arasaka.software`: `/api/info`, `/api/ip`, the download page `/` and `/privacy` (en, it), `/download/{platform}` from the latest Gitea release, the probe (`/api/probe/ticket`, `/api/probe/{id}`) and shared findings (`/api/share`, files under `/var/lib/meweb/shares`, swept after `KeepDays`) |
 | `data/languages.json` | 113 languages: code, autonym, English name, `rtl`, `reviewed` or `draft` |
 | `data/isps/*.json` | provider profiles: AS numbers, and per fact a value, who said it (`basis`), the source URL and the month |
-| `tools/knowledge.cs` | downloads iptoasn's `ip2asn-combined.tsv.gz` (cached in `tools/cache`, 12 h) and writes the brotli table `artifacts/knowledge/ip2asn.bin` (~2 MB), embedded by `MeWeb.Core` when present; `tools/release.cs` runs it before every app build |
+| `src/MeWeb.Server/KnowledgeFeeder.cs` | refreshes the open network data under `/var/lib/meweb/knowledge` every six hours (iptoasn daily, DB-IP monthly, a RouteViews RIB weekly through `bzcat`, the AOSP carrier list weekly), builds `ip2asn.bin`, `networks.bin`, `carriers.json` and `SOURCES.txt` with `MeWeb.Core/Knowledge/Sources.cs`, and serves them at `/api/knowledge` |
+| `tools/knowledge.cs` | takes the server's knowledge files (`MEWEB_KNOWLEDGE_URL`, default the public server; the release sets `http://127.0.0.1:5480` after deploying the server first) into `artifacts/knowledge/`, checking each SHA-256, and falls back to building `ip2asn.bin` alone from iptoasn (`--local` forces that); `MeWeb.Core` embeds whatever is there; `tools/release.cs` runs it before every app build |
 | `tools/setup.cs` + `setup.json` | pinned build tools |
 | `tools/Screenshots` | headless renders of every view in every language |
 | `branding/` | the icon (SVG source, PNG, ICO) |
@@ -101,6 +102,19 @@ The Android release key: alias `meweb`, certificate SHA-256
 - **The route is drawn, never trusted.** `Route.Trace` (8 TTLs) feeds the path's wires: hops after the first, up to
   the first public one, sit before the shared exit or the provider; public ones carry their AS number into the
   internet; unanswered runs collapse to "…". The NAT verdict never reads them (see the 100.64 pitfall).
+- **The knowledge build must fit the unit's `MemoryMax=512M`.** It peaked at 551 MB with Server GC on a 32-core
+  machine; workstation GC (the server's csproj), streaming hashes and streaming the iptoasn ranges into compact
+  tuples brought it to about 335 MB. Re-measure (`VmHWM`) after touching `Sources.cs` or `AsnTable.Write`.
+- **The server cannot ping**: `NoNewPrivileges` drops `ping`'s file capability and `ping_group_range` is closed, so
+  the trace back to a caller uses `tracepath` (UDP, unprivileged) and keeps only public hops outside `Probe:Refuse`,
+  so the box's own network never reaches an app.
+- **Port facts are a lower bound.** Sixteen bindings see a few ports of a provider's block; the block estimate
+  widens with each check on the same public address (`HistoryStore.PortRange`), so "up to about N customers" is an
+  upper bound that only falls over time. The mapping lifetime test (30 s and 120 s) runs after the check and updates
+  the card; a NAT that reuses the same port after expiry reads as "kept".
+- **5G non-standalone reports LTE** as the data network type; the display-info callback (Android 12+) gives the
+  override the status bar shows. The radio type needs `READ_BASIC_PHONE_STATE` (Android 13+), asked during the
+  first check on mobile data.
 - **Download speed is timed after the first quarter of the sample**, once TCP has ramped up: on mobile the sample is
   2 MB and the whole-transfer figure was mostly the ramp.
 - **A Lucide icon joined from several SVG elements must start each one with an absolute `M`.** A leading `m` is