fix(io,tunnel): nil deref in RecorderObjectFromContext, CloseRead checked Writer, SetReadDeadline no unwrap

- entrypoint.go: guard ictx.RecorderObjectFromContext with nil checks on
  ClientID and Redirect assignments
- io.go: fix CloseRead checking Writer instead of Reader, add Reader
  fallback to CloseWrite, unwrap *readWriter/*readWriteCloser in
  SetReadDeadline to reach underlying net.Conn
- docs: add package doc and exported symbol comments to internal/ctx
  and internal/io

handler/tunnel/entrypoint.go

@@ -147,8 +147,9 @@ func (ep *entrypoint) dial(ctx context.Context, network, addr string) (conn net.
 		return nil, fmt.Errorf("%w %s", ErrTunnelRoute, addr)
 	}
 
-	ro := ictx.RecorderObjectFromContext(ctx)
-	ro.ClientID = tunnelID.String()
+	if ro := ictx.RecorderObjectFromContext(ctx); ro != nil {
+		ro.ClientID = tunnelID.String()
+	}
 
 	if tunnelID.IsPrivate() {
 		return nil, fmt.Errorf("%w: tunnel %s is private for host %s", ErrPrivateTunnel, tunnelID, addr)
@@ -172,8 +173,11 @@ func (ep *entrypoint) dial(ctx context.Context, network, addr string) (conn net.
 	}
 	log.Debugf("dial: connected to host %s, tunnel: %s, connector: %s", addr, tunnelID, cid)
 
+	ro := ictx.RecorderObjectFromContext(ctx)
 	if node == ep.node {
-		ro.Redirect = ""
+		if ro != nil {
+			ro.Redirect = ""
+		}
 
 		var clientAddr string
 		if addr := xctx.SrcAddrFromContext(ctx); addr != nil {
@@ -197,7 +201,9 @@ func (ep *entrypoint) dial(ctx context.Context, network, addr string) (conn net.
 			return nil, err
 		}
 	} else {
-		ro.Redirect = node
+		if ro != nil {
+			ro.Redirect = node
+		}
 	}
 
 	return conn, nil