docs(handler/tunnel): add architecture documentation and fix observeStats event loss

- Add package-level architecture doc in handler.go covering:
  - NAT traversal reverse proxy architecture
  - CmdBind/CmdConnect roles and data flow
  - Connector lifecycle and waitClose semantics
  - Entrypoint protocol dispatch (first-byte sniffing)
  - SD fallback behavior
- Add data-flow-oriented doc comments to all business files:
  - entrypoint.go: protocol dispatch, dial flow
  - connector.go: Connector/ConnectorPool semantics
  - dialer.go: two-phase dial strategy
  - tunnel.go: MaxWeight semantics, selection algorithm
  - bind.go: 6-step CmdBind flow
  - connect.go: CmdConnect flow with relay framing
  - ephttp.go, eptls.go, eprelay.go: per-protocol entrypoint flow
- Fix observeStats: after successful error retry, also flush new events
  instead of skipping the current tick (handler.go:261-271)
- Add test for observeStats retry-then-flush (handler_test.go)

handler/tunnel/eprelay.go

@@ -12,6 +12,20 @@ import (
 	xrecorder "github.com/go-gost/x/recorder"
 )
 
+// handleConnect (entrypoint relay) processes a relay-protocol connection
+// arriving at the entrypoint.
+//
+// Flow:
+//  1. Read relay.Request (extracts src/dst address, tunnelID, network).
+//  2. Dialer.Dial() → pool.Get() → GetConn() → mux.OpenStream().
+//  3. Write StatusOK response to the public connection.
+//  4. Write relay.Response with src/dst address features to the mux stream.
+//  5. Pipe(publicConn, muxStream).
+//
+// Unlike tunnelHandler.handleConnect, this path does not use ingress routing
+// or bypass checks — the relay request already contains the tunnel ID.
+// Also unlike handleConnect, there is no local-vs-remote framing difference:
+// the entrypoint always writes StatusOK + address features regardless of node.
 func (ep *entrypoint) handleConnect(ctx context.Context, conn net.Conn, ro *xrecorder.HandlerRecorderObject, log logger.Logger) (err error) {
 	req := relay.Request{}
 	if _, err := req.ReadFrom(conn); err != nil {