feat(synth): add LFO modulation, ADSR envelopes, pentatonic tuning, and soft limiter

Replace static EMA-smoothed drones with an evolving ambient soundscape:
- ADSR envelope system with sustained (2s attack, 4s release) and bursty
  (30ms attack, no sustain) modes per protocol group
- LFO pitch wobble and amplitude tremolo with incommensurable rates per
  group (Eno technique) so modulation patterns never repeat
- C major pentatonic frequency tuning (just intonation) — any combination
  of active protocols sounds consonant
- tanh soft limiter on master output prevents clipping
- Sync all documentation: README, PROJECT.md, ARCHITECTURE.md, v1.2
  requirements traceability

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.planning/PROJECT.md

@@ -10,7 +10,7 @@ Network traffic patterns are instantly recognizable as distinct sounds — a pin
 
 ## Current State
 
-**v1.2 shipped.** 35 built-in traffic classes across 9 protocol families (Infrastructure, Web, Mail, Remote Access, File Transfer, Database, Discovery, VoIP, Unknown). Major-second frequency ladder (65-3250 Hz) with family-coherent sound design. Group-ordered `--print-config` with section headers. `[groups]` TOML config for reassigning protocols to different sound families. ~6,000 lines of Go across 7 packages, full test suite green.
+**v1.2 shipped.** 35 built-in traffic classes across 9 protocol families (Infrastructure, Web, Mail, Remote Access, File Transfer, Database, Discovery, VoIP, Unknown). C major pentatonic frequency tuning (just intonation, 65-6534 Hz) with ADSR envelope shaping (sustained vs bursty modes), LFO pitch/tremolo modulation (Eno technique with incommensurable rates), and tanh soft limiter. Group-ordered `--print-config` with section headers. `[groups]` TOML config for reassigning protocols to different sound families. ~6,500 lines of Go across 7 packages, full test suite green.
 
 Tech stack: gopacket/gopacket v1.5.0, packetcap/go-pcap (pure Go capture), sjzar/go-lame v0.0.9 (embedded LAME), spf13/cobra v1.10.2, BurntSushi/toml v1.6.0.
 
@@ -25,8 +25,8 @@ All v1.0 + v1.1 + v1.2 requirements validated (45 total). Full pipeline: capture
 - Auto-cluster unrecognized traffic into 4 hash-bucketed unknown classes with distinct tones
 - Aggregate traffic into 500ms time windows driving amplitude evolution
 - End-to-end pipeline: capture -> classify -> synthesize -> MP3 output
-- Map each traffic class to a distinct ambient/drone layer (sine oscillators + EMA smoothing)
-- Stereo mixing with constant-power panning, no distortion
+- Map each traffic class to a distinct ambient layer with ADSR envelopes, LFO modulation, and pentatonic tuning
+- Stereo mixing with constant-power panning and tanh soft limiting
 - MP3 encoding via embedded LAME, zero-packet guard
 - CLI with `-i`, `-o`, `--list-interfaces`, `--verbose`, `--filter`, `--read` flags
 - BPF capture filter for scoping live traffic
@@ -49,8 +49,11 @@ All v1.0 + v1.1 + v1.2 requirements validated (45 total). Full pipeline: capture
 - Removed stale constants and future-proofed test bounds for extensibility
 - 21 new protocol classifications: Mail (IMAP, POP3, SMTP-sub), File Transfer (FTP, SMB, TFTP), Remote Access (RDP, Telnet, VNC), Database (MySQL, PostgreSQL, Redis, MongoDB), Discovery (mDNS, SSDP, SNMP), VoIP (SIP), Web (QUIC/HTTP3), Infrastructure (LDAP, Kerberos, Syslog)
 - No regression in existing 14 protocol classifications
-- Major-second frequency ladder with family-coherent waveforms and group field on FreqConfig
-- Auto-assign frequency range moved to 2500-4000 Hz (collision-free with built-ins)
+- C major pentatonic frequency tuning (just intonation) with family-coherent waveforms and group field on FreqConfig
+- ADSR envelope system: sustained protocols (2s attack, 4s release) and bursty protocols (30ms attack, no sustain)
+- LFO modulation: per-group incommensurable pitch wobble and amplitude tremolo (Eno technique)
+- Tanh soft limiter on master output prevents clipping
+- Auto-assign frequency range moved to 5000-8000 Hz (collision-free with built-ins)
 - Group-ordered `--print-config` output with section headers
 - `[groups]` TOML config for protocol-to-group reassignment
 
@@ -62,7 +65,7 @@ All v1.0 + v1.1 + v1.2 requirements validated (45 total). Full pipeline: capture
 
 - Real-time audio playback — file output only
 - GUI or web interface — CLI only
-- Rhythmic/percussive output — ambient/drone style only
+- Fully rhythmic/beat-based output — ambient style with percussive accents for bursty protocols
 - Stereo position configuration — add in future if requested
 
 ## Context
@@ -93,7 +96,10 @@ All v1.0 + v1.1 + v1.2 requirements validated (45 total). Full pipeline: capture
 | go-lame (embedded C) over shine-mp3 | Better quality, smaller files, acceptable CGo tradeoff | Good |
 | Hand-rolled synthesis over audio libraries | 20 lines of oscillator code, no unnecessary dependencies | Good |
 | Hash-bucketed unknowns over k-means | Deterministic, zero-config, sufficient for v1 audio distinction | Good |
-| Major-second frequency ladder | Musical interval spacing prevents critical band masking between family members | Good |
+| C major pentatonic tuning (just intonation) | Any combination of active tones sounds consonant; replaced major-second ladder | Good |
+| ADSR envelopes over pure EMA | Sustained flows get ambient pads; bursty protocols get percussive accents | Good |
+| LFO with incommensurable rates | Eno technique ensures soundscape never repeats; each group has unique modulation | Good |
+| Tanh soft limiter over hard clipping | Preserves dynamics while preventing distortion during traffic spikes | Good |
 | Group field as string (not enum) | Extensible for new family names without code changes | Good |
 | Ordered []Rule classifier over switch | Configurable, extensible, first-match-wins semantics | Good |
 | 500ms window duration | Balances temporal resolution against snapshot frequency for synthesis | Good |