address PR review: SRV port, drop spike, percent-encoded paths

- SRV record uses first service's port (was 0, confused dns-sd -L)
- Remove examples/mdns_coexist.rs (served its purpose as spike)
- Reject percent-encoding in route paths (defense-in-depth)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/api.rs

@@ -777,8 +777,11 @@ async fn add_route(
     if req.path.is_empty() || !req.path.starts_with('/') {
         return Err((StatusCode::BAD_REQUEST, "path must start with /".into()));
     }
-    if req.path.contains("/../") || req.path.ends_with("/..") {
-        return Err((StatusCode::BAD_REQUEST, "path must not contain '..'".into()));
+    if req.path.contains("/../") || req.path.ends_with("/..") || req.path.contains("%") {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            "path must not contain '..' or percent-encoding".into(),
+        ));
     }
     if req.port == 0 {
         return Err((StatusCode::BAD_REQUEST, "port must be > 0".into()));

src/lan.rs

@@ -256,7 +256,7 @@ fn build_announcement(
     let rdata_start = buf.pos();
     buf.write_u16(0)?; // priority
     buf.write_u16(0)?; // weight
-    buf.write_u16(0)?; // port (services have individual ports in TXT)
+    buf.write_u16(services.first().map(|(_, p)| *p).unwrap_or(0))?; // first service port for SRV display
     buf.write_qname(&host_local)?;
     patch_rdlen(&mut buf, rdlen_pos, rdata_start)?;