fix(handler/masque): add recorder stats, idle timeout, reorder auth/DNS/200

Wire pStats into sub-handlers to capture real byte counts from QUIC
streams instead of the dummy listener conn. Resolve target address and
validate capsule-protocol after authentication instead of before 200
response to prevent dead tunnels and unauthenticated probing. Merge
pending observer events rather than replacing on consecutive failures.
Add idle read timeout to TCP tunnel relay. Add doc comments on exported
symbols and NewHandler.

handler/masque/metadata.go

@@ -15,7 +15,8 @@ const (
 type metadata struct {
 	hash           string
 	bufferSize     int
-	authBasicRealm string
+	authBasicRealm          string
+	idleTimeout             time.Duration
 
 	observerPeriod         time.Duration
 	observerResetTraffic   bool
@@ -42,6 +43,8 @@ func (h *masqueHandler) parseMetadata(md mdata.Metadata) (err error) {
 	}
 
 	h.md.observerResetTraffic = mdutil.GetBool(md, "observer.resetTraffic")
+	h.md.idleTimeout = mdutil.GetDuration(md, "readTimeout", "read.timeout", "idleTimeout")
+
 	h.md.limiterRefreshInterval = mdutil.GetDuration(md, "limiter.refreshInterval")
 	h.md.limiterCleanupInterval = mdutil.GetDuration(md, "limiter.cleanupInterval")