docs(handler/tunnel): add architecture documentation and fix observeStats event loss

- Add package-level architecture doc in handler.go covering:
  - NAT traversal reverse proxy architecture
  - CmdBind/CmdConnect roles and data flow
  - Connector lifecycle and waitClose semantics
  - Entrypoint protocol dispatch (first-byte sniffing)
  - SD fallback behavior
- Add data-flow-oriented doc comments to all business files:
  - entrypoint.go: protocol dispatch, dial flow
  - connector.go: Connector/ConnectorPool semantics
  - dialer.go: two-phase dial strategy
  - tunnel.go: MaxWeight semantics, selection algorithm
  - bind.go: 6-step CmdBind flow
  - connect.go: CmdConnect flow with relay framing
  - ephttp.go, eptls.go, eprelay.go: per-protocol entrypoint flow
- Fix observeStats: after successful error retry, also flush new events
  instead of skipping the current tick (handler.go:261-271)
- Add test for observeStats retry-then-flush (handler_test.go)

handler/tunnel/entrypoint.go

@@ -24,8 +24,23 @@ import (
 )
 
 // entrypoint is a public tunnel entry point that accepts external connections
-// and routes them through the tunnel network. It supports three protocols
-// determined by the first byte of the connection: relay (Version1), TLS, or HTTP.
+// and routes them through the tunnel network.
+//
+// Protocol dispatch is done by peeking at the first byte of the connection:
+//   - relay.Version1 (0x52 'R') → relay protocol  (handleConnect)
+//   - dissector.Handshake (0x16) → TLS passthrough (handleTLS)
+//   - otherwise                  → HTTP proxy      (handleHTTP)
+//
+// For HTTP/TLS paths, the dial flow is:
+//   ep.dial() → ingress lookup (host → tunnelID) → Dialer.Dial()
+//   → ConnectorPool.Get() → Connector.GetConn() → mux.OpenStream()
+//   → relay.Response{src, dst} written to mux stream (when local node)
+//
+// The relay protocol path handles its own tunnel ID extraction from the
+// relay request frame.
+//
+// When Dialer falls back to SD (no local connector), the mux layer is
+// bypassed and a raw TCP connection is established to the remote node.
 type entrypoint struct {
 	node      string
 	service   string