Default-off 6 options (file-transfer, clipboard, keyboard, tunnel, record-session, camera) + force-on 2 NAT punch options

For 4 users on 5 Mbps server (114.55.133.123) where file transfers were saturating bandwidth:

Turn OFF by default (users can still flip on per-session):
- enable-file-transfer: THE KILLER (1 GB upload = 2 GB server bandwidth)
- enable-clipboard: 50 kbps + privacy
- enable-keyboard: only needed for typing-on-remote
- enable-tunnel: prevents using server as jump host
- enable-record-session: only when explicitly recording
- enable-camera: 500 kbps; rarely used for support
- enable-audio: (already in c94a72a)

Force ON (overrides RustDesk's conservative default for self-hosted servers):
- enable-udp-punch, enable-ipv6-punch: src/common.rs:1107 turns these off
  when rendezvous server is non-public. That's a safety measure meant for
  untrusted public servers, but our self-hosted server is fully trusted.
  Force-enabling boosts P2P success rate → less relay (21117) traffic →
  less server bandwidth.

src/common.rs

@@ -2102,15 +2102,45 @@ pub fn load_custom_client() {
         read_custom_client(&data.trim());
     }
 
-    // Custom fork: hardcode enable-audio = N as the default. User can still flip it on in Settings.
+    // Custom fork: hardcode bandwidth-heavy / sensitive defaults to off.
     // Reason: RustDesk's official custom.txt path requires ed25519-signed base64 (see
     // read_custom_client at line 2191 — decode64 + sign::verify with key
     // "5Qbwsde3unUcJBtrx9ZkvUmwFNoExHzpryHuPUdqlWM="), which we can't produce without the
     // official signing key. So we bypass custom.txt and inject directly into DEFAULT_SETTINGS.
-    // entry().or_insert() preserves the priority chain: OVERWRITE_SETTINGS → CONFIG2 → DEFAULT_SETTINGS.
+    // entry().or_insert() preserves the priority chain: OVERWRITE_SETTINGS → CONFIG2 → DEFAULT_SETTINGS,
+    // so users can still override any of these in their own RustDesk2.toml.
+    //
+    // Why each one is off (user has 4 users on 5 Mbps server, file transfers were saturating it):
+    //   enable-audio           — not needed for 4-user remote support; saves 64 kbps/session
+    //   enable-file-transfer   — THE KILLER: 1 GB upload = 2 GB server bandwidth (in + out)
+    //   enable-clipboard       — 50 kbps + privacy; rarely needed for remote support
+    //   enable-keyboard        — only needed for typing-on-remote scenarios
+    //   enable-tunnel          — TCP tunneling = users abusing server as a jump host
+    //   enable-record-session  — only needed if explicitly recording
+    //   enable-camera          — 500 kbps; rarely used for support
     {
         let mut defaults = config::DEFAULT_SETTINGS.write().unwrap();
         defaults.entry("enable-audio".to_string()).or_insert("N".to_string());
+        defaults.entry("enable-file-transfer".to_string()).or_insert("N".to_string());
+        defaults.entry("enable-clipboard".to_string()).or_insert("N".to_string());
+        defaults.entry("enable-keyboard".to_string()).or_insert("N".to_string());
+        defaults.entry("enable-tunnel".to_string()).or_insert("N".to_string());
+        defaults.entry("enable-record-session".to_string()).or_insert("N".to_string());
+        defaults.entry("enable-camera".to_string()).or_insert("N".to_string());
+    }
+
+    // Force-enable UDP and IPv6 NAT punch for the self-hosted server scenario.
+    // Background: get_local_option() at src/common.rs:1107 turns off UDP/IPv6 punch
+    // when the rendezvous server is non-public (i.e. self-hosted). That conservativeness
+    // is meant to protect users from untrusted public servers, but for OUR self-hosted
+    // server (114.55.133.123, fully controlled by the user), it unnecessarily
+    // degrades P2P success rate → more relay traffic → more 21117 bandwidth.
+    // Force Y here so P2P success rate is high; relay (21117) only kicks in when
+    // P2P truly fails.
+    {
+        let mut locals = config::OVERWRITE_LOCAL_SETTINGS.write().unwrap();
+        locals.entry("enable-udp-punch".to_string()).or_insert("Y".to_string());
+        locals.entry("enable-ipv6-punch".to_string()).or_insert("Y".to_string());
     }
 }