Exit nodes on Windows: offer through WinNAT; using is refused

Windows reported exit nodes as unsupported. The offering side now creates one
WinNAT object per offered range (New-NetNat, named tsunagi-exit:<if>:<range>),
prunes this interface's stale ones, reads (never writes) IPv4 forwarding of
the overlay interface, and removes everything on clear. All values are
single-quoted PowerShell literals.

The using side is deliberately not implemented: Windows has no per-user or
per-process routing, so the agent's own QUIC/relay traffic cannot be kept out
of a default route through the overlay and would loop. It reports that reason
and installs no route. The CLI/tray forwarding hint and the kernel-forwarding
warning name the Windows command; docs/exit-node.md has a Windows section.

Checks: cargo fmt --check, cargo clippy --locked --workspace --all-targets
-D warnings and cargo test --locked --workspace --all-targets passed on macOS.
The script builders and plan logic are unit-tested with an injected runner on
every platform; nothing was run against a real Windows host or cross-compiled
(no Windows target installed).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs/exit-node.md

@@ -80,6 +80,21 @@ is built from `pf` and `route`. The agent runs as root there.
 - Not verified on a live host when this was written: run `tsng exit-node` and
   check `sudo pfctl -a com.apple/tsunagi-exit-utunN -s rules -s nat`.
 
+## Windows
+
+Offering only. Each offered range gets a WinNAT object
+`tsunagi-exit:<interface>:<range>` (`New-NetNat`), removed with the offer, the
+network and the agent. Forwarding is read for the overlay interface and never
+changed; Windows forwards per interface, so enable it on the ones involved
+(`Get-NetIPInterface | Set-NetIPInterface -Forwarding Enabled`, administrator
+PowerShell). Some Windows versions allow one NAT per host; a second range then
+reports its own failure.
+
+Using one is **not available**: Windows has no per-user routing, so the agent's
+own traffic cannot be kept out of a default route through the overlay and would
+loop. `tsng exit-node <name>` reports that and installs nothing. This was
+written without a Windows host to run it on.
+
 ## What it does not do
 
 - **The agent must run as a system service** (its own user). The uid exemption