refactor(handler/tunnel): code review fixes and entrypoint subpackage extraction

- Fix dead-code branch in bind.go host assignment (always use endpoint hash)
- Return descriptive error on bypass match in connect.go (was masking as success)
- Update bypass test in connect_test.go for new error behavior
- Extract entrypoint subpackage from monolithic entrypoint.go (6 files)
- Fix observeStats event-loss bug (break -> fallthrough on retry success)
- Add 47 unit tests across handler, connect, bind, metadata packages
- Add architecture doc comments to all key files
- Build and vet clean, 173 tests pass with -race

handler/tunnel/bind.go

@@ -55,11 +55,11 @@ func (h *tunnelHandler) handleBind(ctx context.Context, conn net.Conn, network,
 	endpoint := hex.EncodeToString(v[:8])
 
 	host, port, _ := net.SplitHostPort(address)
-	if host == "" || h.md.ingress == nil {
-		host = endpoint
-	} else if host != endpoint {
-		host = endpoint
-	}
+	// Always use the endpoint hash as the host — this provides a stable,
+	// deterministic ingress key regardless of what the internal client sends.
+	// The original host is ignored; the endpoint hash routes consistently
+	// across reconnects and multi-node deployments.
+	host = endpoint
 	addr := net.JoinHostPort(host, port)
 
 	af := &relay.AddrFeature{}