contrib: add read-only incoming connectivity diagnostics

[EasyAsABC123]

Mousehole can successfully update MAM while incoming BitTorrent connections still fail. In a NAT-PMP VPN setup, outbound requests and the working forwarded port can use different public IPs; waiting for another successful update does not establish that the incoming path recovered.

This adds a community diagnostic under contrib/connectivity-check, linked from the network troubleshooting guide. It collects a fresh, sanitized snapshot on a Linux Docker host, then lets a separate machine verify the measured endpoints with a BitTorrent handshake against an existing active seed.

• Inspect actual network namespaces, container health, current forwarded/listening ports, the unauthenticated MAM-observed IP, a fresh NAT-PMP external-address query, bounded tracker status, and optional Mousehole contact timing.
• Distinguish a valid handshake from TCP-only reachability. Reject stale or changing snapshots, unsuitable endpoints, mismatched ports/namespaces, malformed handshakes, and echoed probes. Different public IPs alone do not establish failure.
• Use container DNS with verified HTTPS. Keep the optional Mousehole token on the inspection host and pass it to the namespace helper through stdin; redact credentials, tracker URLs, passkeys, torrent names, and hashes from reports.

The helper performs no authenticated MAM updates, port-mapping changes, service restarts, or preference changes. It leaves /health and the application/image unchanged. Neither HTTP 200 nor an external handshake claims that MAM currently displays the account as connectable.

Validation: 37 offline Python tests pass and are added to CI. All existing formatting, lint, type, and test checks pass, including 219 Vitest tests. A live Gluetun/qBittorrent/Mousehole check reproduced an observed-IP timeout alongside a valid handshake at the current NAT-PMP endpoint, with healthy shared namespaces and aligned ports. Deployment-specific addresses, credentials, and torrent identifiers are excluded from this contribution.