fix(handler/sshd): unwrap limiter wrappers to fix wrong connection type (issue #867)

The sshd handler performed a concrete type assertion on the accepted
connection, but the SSH listener's Accept() wraps each connection with
a traffic limiter (limitConn), obscuring the underlying *DirectForwardConn
type and causing 'sshd: wrong connection type' whenever a limiter was
configured.

Add an UnwrapConn() method to the traffic limiter wrapper and an
unwrapConn() helper in the handler that peels through wrapper layers
before the type switch. The handler uses the unwrapped conn only for
the type-specific DstAddr() call, while the original limiter-wrapped
conn drives data transfer so rate limiting remains effective.

Also track the last accept/bind error on service Status so callers can
retrieve the cause when a service enters the failed state.

service/service.go

@@ -223,6 +223,7 @@ func (s *defaultService) Serve() error {
 				}
 
 				s.setState(StateFailed)
+				s.status.setLastError(e)
 
 				log.Warnf("accept: %v, retrying in %v", e, tempDelay)
 				time.Sleep(tempDelay)
@@ -242,6 +243,7 @@ func (s *defaultService) Serve() error {
 		if tempDelay > 0 {
 			tempDelay = 0
 			s.setState(StateReady)
+			s.status.setLastError(nil)
 		}
 
 		ctx := gctx

service/status.go

@@ -37,6 +37,7 @@ type Status struct {
 	state      State
 	events     []Event
 	stats      stats.Stats
+	lastError  error
 	mu         sync.RWMutex
 }
 
@@ -81,6 +82,24 @@ func (p *Status) addEvent(event Event) {
 	p.events = append(p.events, event)
 }
 
+// LastError returns the last accept/bind error that caused the service to
+// enter StateFailed. Returns nil if the service never entered the failed state.
+func (p *Status) LastError() error {
+	if p == nil {
+		return nil
+	}
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+	return p.lastError
+}
+
+// setLastError stores the last accept/bind error for retrieval via LastError().
+func (p *Status) setLastError(err error) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.lastError = err
+}
+
 // Stats returns the traffic statistics for the service. It safely handles nil
 // receivers by returning nil.
 func (p *Status) Stats() stats.Stats {