Add the native Go client and finish M3 hardening

The new cmd/tunnel client keeps the API URL and tunnel identity in
~/.config/tunnel/config.json (0600), provisions the key/CSR and
certificate, terminates TLS, proxies to local routes, reloads routes
without a restart, and runs as a background service. `tunnel import`
takes over an existing official CLI profile, preserving its tunnel ID,
token, key and certificate.

Server hardening: per-IP and per-tunnel rate limits for creates and
binds, a CA cool-down after repeated ACME failures, a startup sweep for
stale _acme-challenge records, admin metrics, a 60-second half-close
timeout, and separate prioritized control / ordered data bridge queues
(with `end` ordered after the final bytes). The dashboard shows the new
metrics.

internal/server/dns.go

@@ -14,6 +14,13 @@ type DNSProvider interface {
 	DeleteTXT(ctx context.Context, name string) error
 }
 
+// ChallengeSweeper is implemented by providers that can remove leftover
+// challenge records at startup (for example after a process was killed
+// mid-issuance).
+type ChallengeSweeper interface {
+	SweepChallenges(ctx context.Context) (int, error)
+}
+
 // challengeRecordName is the TXT record name a hostname's DNS-01 challenge
 // lives at; the wildcard of a hostname shares the same record.
 func challengeRecordName(hostname string) string {