Add the native Go client and finish M3 hardening

The new cmd/tunnel client keeps the API URL and tunnel identity in
~/.config/tunnel/config.json (0600), provisions the key/CSR and
certificate, terminates TLS, proxies to local routes, reloads routes
without a restart, and runs as a background service. `tunnel import`
takes over an existing official CLI profile, preserving its tunnel ID,
token, key and certificate.

Server hardening: per-IP and per-tunnel rate limits for creates and
binds, a CA cool-down after repeated ACME failures, a startup sweep for
stale _acme-challenge records, admin metrics, a 60-second half-close
timeout, and separate prioritized control / ordered data bridge queues
(with `end` ordered after the final bytes). The dashboard shows the new
metrics.

internal/server/proto.go

@@ -97,6 +97,12 @@ type errUnauthorized struct {
 	Message string `json:"message"`
 }
 
+// errRateLimited is the 429 body used by the reference's limits.
+type errRateLimited struct {
+	Tag     string `json:"_tag"`
+	Message string `json:"message"`
+}
+
 type errTaggedID struct {
 	Tag      string `json:"_tag"`
 	TunnelID string `json:"tunnelID"`