android: a tunnel the server dropped silently is noticed in about two minutes instead of never: the NAT keepalive tick sends a DPD once IPsec traffic went out and nothing at all came back for 90 s (charon.keep_alive_dpd_inbound; a session stayed «connected» for 18 min after the server went quiet); no timer of its own, no probe on an idle tunnel, without a path, or counted from before a suspend, and while answered probes are all that comes back the wait doubles up to 6 min; the tick also runs with forced UDP encapsulation without a NAT; diag.log gets the ESP in/out byte counters

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

conf/options/charon.opt

@@ -259,6 +259,14 @@ charon.keep_alive_dpd_margin = 0s
 	sent instead of a NAT keep alive (0 to disable).  This is only useful if a
 	clock is used that includes time spent suspended (e.g. CLOCK_BOOTTIME).
 
+charon.keep_alive_dpd_inbound = 0s
+	Number of seconds without any inbound packet, while IPsec traffic was sent,
+	after which a DPD is sent from the NAT keep alive tick (0 to disable).  It
+	detects a peer that dropped the SA silently without a separate DPD timer;
+	the first tick after a suspend or a lost path is skipped.  While answered
+	probes are all that comes back (traffic nobody replies to), the time is
+	doubled after each probe, up to four times the configured value.
+
 charon.leak_detective.detailed = yes
 	Includes source file names and line numbers in leak detective output.