docs(handler/tunnel): add architecture documentation and fix observeStats event loss

- Add package-level architecture doc in handler.go covering:
  - NAT traversal reverse proxy architecture
  - CmdBind/CmdConnect roles and data flow
  - Connector lifecycle and waitClose semantics
  - Entrypoint protocol dispatch (first-byte sniffing)
  - SD fallback behavior
- Add data-flow-oriented doc comments to all business files:
  - entrypoint.go: protocol dispatch, dial flow
  - connector.go: Connector/ConnectorPool semantics
  - dialer.go: two-phase dial strategy
  - tunnel.go: MaxWeight semantics, selection algorithm
  - bind.go: 6-step CmdBind flow
  - connect.go: CmdConnect flow with relay framing
  - ephttp.go, eptls.go, eprelay.go: per-protocol entrypoint flow
- Fix observeStats: after successful error retry, also flush new events
  instead of skipping the current tick (handler.go:261-271)
- Add test for observeStats retry-then-flush (handler_test.go)

handler/tunnel/ephttp.go

@@ -26,6 +26,21 @@ import (
 	"golang.org/x/net/http/httpguts"
 )
 
+// handleHTTP processes an HTTP request arriving at the entrypoint.
+//
+// Flow:
+//  1. Read HTTP request from the public connection.
+//  2. Record request metadata in ro.HTTP.
+//  3. httpRoundTrip: shallow-copy ro, check forwarding loop,
+//     build http.Request, call ep.transport.RoundTrip() which
+//     uses ep.dial() as DialContext — that resolves ingress rules
+//     to a tunnelID, calls Dialer.Dial(), and writes relay address
+//     features into the mux stream.
+//  4. Handle WebSocket upgrade via handleUpgradeResponse (sniffing).
+//  5. Continue in a loop for keep-alive: read next request, repeat.
+//
+// HTTP request body recording: if recorder options specify HTTPBody,
+// the request body is wrapped in a xhttp.Body for capture.
 func (ep *entrypoint) handleHTTP(ctx context.Context, conn net.Conn, ro *xrecorder.HandlerRecorderObject, log logger.Logger) (err error) {
 	pStats := xstats.Stats{}
 	conn = stats_wrapper.WrapConn(conn, &pStats)