feat(synth): add LFO modulation, ADSR envelopes, pentatonic tuning, and soft limiter

Replace static EMA-smoothed drones with an evolving ambient soundscape:
- ADSR envelope system with sustained (2s attack, 4s release) and bursty
  (30ms attack, no sustain) modes per protocol group
- LFO pitch wobble and amplitude tremolo with incommensurable rates per
  group (Eno technique) so modulation patterns never repeat
- C major pentatonic frequency tuning (just intonation) — any combination
  of active protocols sounds consonant
- tanh soft limiter on master output prevents clipping
- Sync all documentation: README, PROJECT.md, ARCHITECTURE.md, v1.2
  requirements traceability

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

README.md

@@ -121,7 +121,7 @@ If no config is found, NetSynth starts silently with built-in defaults.
 # Only the fields you set are changed — everything else keeps its default.
 
 [sounds.ICMP]
-frequency = 80.0        # Hz (default: 65.0)
+frequency = 80.0        # Hz (default: 65.4)
 waveform = "triangle"   # sine, square, sawtooth, or triangle
 
 [sounds.HTTPS]
@@ -231,25 +231,33 @@ Capture -> Classify -> Aggregate -> Synthesize -> MP3
 
 3. **Aggregate** — Classified packets are grouped into 500ms time windows. Each window records per-protocol packet counts that drive synthesis amplitudes.
 
-4. **Synthesize & Encode** — Each traffic class maps to an oscillator at a specific frequency, waveform, and stereo position. Amplitudes rise and fall via EMA smoothing based on traffic volume. All layers are mixed and encoded to MP3 via [LAME](https://github.com/sjzar/go-lame).
+4. **Synthesize & Encode** — Each traffic class maps to an oscillator with ADSR envelope shaping, LFO modulation, and stereo positioning. Sustained protocols (HTTPS, SSH) fade in/out over seconds; bursty protocols (DNS, ICMP) produce short percussive accents. All layers are soft-limited and encoded to MP3 via [LAME](https://github.com/sjzar/go-lame).
 
 ### Sound Design
 
-Protocols are grouped into families that share a waveform type and frequency register, making related traffic sound cohesive while remaining distinguishable. Frequencies follow a major-second ladder within each family.
+Protocols are grouped into families that share a waveform type and frequency register, making related traffic sound cohesive while remaining distinguishable. Frequencies are tuned to a **C major pentatonic scale** (just intonation) so that any combination of simultaneously active protocols sounds harmonically consonant.
 
 | Family | Waveform | Frequency Range | Protocols |
 |--------|----------|----------------|-----------|
-| Infrastructure | Triangle | 65-133 Hz | ICMP, NTP, DHCP, mDNS, SSDP, SNMP, DNS |
-| Web | Sawtooth | 150-190 Hz | HTTPS, HTTP, QUIC |
-| Mail | Triangle | 214-305 Hz | SMTP, IMAP, POP3, SMTP-Sub |
-| Remote Access | Square | 343-485 Hz | SSH, RDP, Telnet, VNC |
-| File Transfer | Square | 545-687 Hz | FTP, SMB, TFTP |
-| Unknown | Custom | 771-1375 Hz | Unknown1-4, OtherTCP, OtherUDP |
-| Database | Sawtooth | 1543-2182 Hz | MySQL, PostgreSQL, Redis, MongoDB |
-| VoIP | Sine | 2449 Hz | SIP |
-| Infrastructure (ext.) | Triangle | 2950-3250 Hz | LDAP, Kerberos, Syslog |
+| Infrastructure | Triangle | 65-147 Hz (C2-D3) | ICMP, NTP, DHCP, mDNS, SSDP, SNMP, DNS |
+| Web | Sawtooth | 164-218 Hz (E3-A3) | HTTPS, HTTP, QUIC |
+| Mail | Triangle | 262-392 Hz (C4-G4) | SMTP, IMAP, POP3, SMTP-Sub |
+| Remote Access | Square | 436-654 Hz (A4-E5) | SSH, RDP, Telnet, VNC |
+| File Transfer | Square | 784-1047 Hz (G5-C6) | FTP, SMB, TFTP |
+| Unknown | Custom | 1175-2349 Hz (D6-D7) | Unknown1-4, OtherTCP, OtherUDP |
+| Database | Sawtooth | 2616-4186 Hz (E7-C8) | MySQL, PostgreSQL, Redis, MongoDB |
+| VoIP | Sine | 4704 Hz (D8) | SIP |
+| Infrastructure (ext.) | Triangle | 5232-6534 Hz | LDAP, Kerberos, Syslog |
 
-Sustained traffic sounds louder; quiet periods fade to silence. The result is a unique audio fingerprint of your network activity. All frequencies, waveforms, and group assignments can be overridden via the [config file](#custom-sound-configuration).
+#### Synthesis Features
+
+- **ADSR envelopes** — Sustained protocols (HTTPS, SSH, streaming) fade in over 2 seconds and release over 4 seconds, creating ambient pads. Bursty protocols (DNS, ICMP, NTP) have a fast 30ms attack with no sustain, producing percussive pluck-like accents on each burst.
+- **LFO modulation** — Each protocol group has unique, incommensurable pitch and tremolo LFO rates (Eno technique). Pitch wobbles by a few cents; amplitude pulses gently. The combined modulation pattern never repeats, keeping the soundscape evolving.
+- **Soft limiter** — A tanh-based soft limiter on the master output prevents harsh clipping during traffic spikes while preserving dynamic range.
+- **Bandlimited additive synthesis** — All waveforms (sine, square, sawtooth, triangle) use harmonics below Nyquist to prevent aliasing.
+- **Constant-power stereo panning** — Bass frequencies center, mid-range spreads, higher frequencies pan wider.
+
+The result is an evolving ambient soundscape — not static drones. A typical browsing session produces warm, breathing HTTPS pads with percussive DNS plucks on page loads and gentle ICMP pulses as a periodic heartbeat. All frequencies, waveforms, and group assignments can be overridden via the [config file](#custom-sound-configuration).
 
 ## Project Structure
 
@@ -258,7 +266,7 @@ cmd/netsynth/   CLI entry point (Cobra)
 capture/        Packet capture, BPF validation, pcap file reading
 classify/       Protocol classification rules and types
 aggregate/      Time-window aggregation and summary output
-synth/          Oscillators, waveforms, EMA layers, stereo mixer, tone bank
+synth/          Oscillators, waveforms, ADSR envelopes, LFO modulation, stereo mixer, tone bank
 config/         TOML config loading, validation, and partial merge
 encode/         MP3 encoding via embedded LAME
 ```