fix(tun): forward single-member shared NIC traffic unchanged

Deliver TUN packets directly to the sole attached member without
destination matching or creating source translations. Keep native flow
reservations so a later member cannot collide with existing connections,
and continue applying mappings created before other members leave.

Reuse flow preparation with the original source address. Preserve the
desktop subnet forwarding bypass, including when the flow table is full.
IPv4 fragments and IPv6 extension headers remain unchanged on flows that
need no translation.

Cover unknown sources and destinations, first and later IP fragments,
native flows established before another member joins, and retained
translations after returning to one member. Document the forwarding
behavior and retain rejection coverage for multiple attached members.

docs/core-architecture.md

@@ -460,6 +460,12 @@ preserves the sequence field in each request and reply.
 Removing an involved address or member releases its mappings. A full member
 queue drops that packet without blocking other members or control messages.
 
+With one attached member, packets go directly to that member without destination
+matching or new source translations. Native flow reservations remain active so
+later members cannot reuse their tuples. Existing translations continue in both
+directions after other members leave. Unmodified IPv4 fragments and IPv6
+extension headers pass through the single-member path unchanged.
+
 Reservations are bounded at 4096 flows. Activity in either direction refreshes
 them; table pressure reclaims reservations idle for at least 180 seconds. If
 all slots remain active, new tracked flows are dropped rather than evicting a