docs(handler/tunnel): add architecture documentation and fix observeStats event loss

- Add package-level architecture doc in handler.go covering:
  - NAT traversal reverse proxy architecture
  - CmdBind/CmdConnect roles and data flow
  - Connector lifecycle and waitClose semantics
  - Entrypoint protocol dispatch (first-byte sniffing)
  - SD fallback behavior
- Add data-flow-oriented doc comments to all business files:
  - entrypoint.go: protocol dispatch, dial flow
  - connector.go: Connector/ConnectorPool semantics
  - dialer.go: two-phase dial strategy
  - tunnel.go: MaxWeight semantics, selection algorithm
  - bind.go: 6-step CmdBind flow
  - connect.go: CmdConnect flow with relay framing
  - ephttp.go, eptls.go, eprelay.go: per-protocol entrypoint flow
- Fix observeStats: after successful error retry, also flush new events
  instead of skipping the current tick (handler.go:261-271)
- Add test for observeStats retry-then-flush (handler_test.go)

handler/tunnel/eptls.go

@@ -18,6 +18,16 @@ import (
 	xrecorder "github.com/go-gost/x/recorder"
 )
 
+// handleTLS processes a TLS connection arriving at the entrypoint.
+//
+// Flow:
+//  1. Parse ClientHello (tee-reads first bytes for recording).
+//  2. Extract SNI hostname → ingress lookup → tunnelID.
+//  3. ep.dial() → Dialer.Dial() → mux stream (or SD TCP connection).
+//  4. Write buffered ClientHello bytes to the mux stream.
+//  5. Parse ServerHello from the mux stream (for TLS recording).
+//  6. Write ServerHello bytes back to the public connection.
+//  7. Pipe(publicConn, muxStream) — bidirectional TLS passthrough.
 func (ep *entrypoint) handleTLS(ctx context.Context, conn net.Conn, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
 	buf := new(bytes.Buffer)
 	clientHello, err := dissector.ParseClientHello(io.TeeReader(conn, buf))