refactor(handler/tunnel): code review fixes and entrypoint subpackage extraction

- Fix dead-code branch in bind.go host assignment (always use endpoint hash)
- Return descriptive error on bypass match in connect.go (was masking as success)
- Update bypass test in connect_test.go for new error behavior
- Extract entrypoint subpackage from monolithic entrypoint.go (6 files)
- Fix observeStats event-loss bug (break -> fallthrough on retry success)
- Add 47 unit tests across handler, connect, bind, metadata packages
- Add architecture doc comments to all key files
- Build and vet clean, 173 tests pass with -race

handler/tunnel/tunnel.go

@@ -35,13 +35,17 @@ const (
 //     ConnectorPool.closeIdles on a 15-minute ticker).
 //   - Close() closes all connectors and signals shutdown.
 type Tunnel struct {
-	node       string
+	// node is the tunnel handler node ID that owns this tunnel.
+	node string
+	// id is the relay tunnel ID shared by all connectors in this group.
 	id         relay.TunnelID
 	connectors []*Connector
-	t          time.Time
-	close      chan struct{}
-	mu         sync.RWMutex
-	ttl        time.Duration
+	// t is the creation timestamp — used for debugging/lifecycle tracking.
+	t     time.Time
+	close chan struct{}
+	mu    sync.RWMutex
+	// ttl is the interval between clean() ticks. Defaults to defaultTTL.
+	ttl time.Duration
 }
 
 func NewTunnel(node string, tid relay.TunnelID, ttl time.Duration) *Tunnel {