refactor(handler/tunnel): code review fixes and entrypoint subpackage extraction

- Fix dead-code branch in bind.go host assignment (always use endpoint hash)
- Return descriptive error on bypass match in connect.go (was masking as success)
- Update bypass test in connect_test.go for new error behavior
- Extract entrypoint subpackage from monolithic entrypoint.go (6 files)
- Fix observeStats event-loss bug (break -> fallthrough on retry success)
- Add 47 unit tests across handler, connect, bind, metadata packages
- Add architecture doc comments to all key files
- Build and vet clean, 173 tests pass with -race

handler/tunnel/id.go

@@ -9,10 +9,10 @@ import (
 	"github.com/google/uuid"
 )
 
-// parseTunnelID parses a tunnel ID from a string.
+// ParseTunnelID parses a tunnel ID from a string.
 // If s is empty or contains an invalid UUID, the returned tunnel ID is zero
 // (callers must check IsZero). A leading '$' prefix marks the tunnel as private.
-func parseTunnelID(s string) (tid relay.TunnelID) {
+func ParseTunnelID(s string) (tid relay.TunnelID) {
 	if s == "" {
 		return
 	}