break: replace muxed workers with 1:1 tunnels

Worker frames are now FrameType + payload; there is no stream id.
Each player gets its own worker conn. maxTunnels (default 256)
caps concurrent tunnels. The old maxConn pool size is ignored so
existing configs do not silently admit only a handful of players.

Resume, per-direction windows, the control session, and the
DATA-only shaper stay. A dropped worker still hangs that one
player and reattaches over a fresh conn.

Add a hub-side per-IP limiter for player intents only (default
8/s, burst 16, 64 concurrent). Unmatched hostnames consume a
token; Intent 17 is never counted. 0 disables each knob.

client/wire/framedconn.go

@@ -15,9 +15,9 @@ import (
 const MaxFrame = 1 << 20
 
 // WriteTimeout bounds a single frame write. A peer that stops reading must not
-// be able to park every stream on the connection inside WriteFrame forever: the
-// write mutex is held for the whole socket write, so one stalled write would
-// otherwise wedge the entire multiplexed connection.
+// be able to park this connection inside WriteFrame forever: the write mutex
+// is held for the whole socket write, so one stalled write would otherwise
+// wedge liveness (PING/PONG) and WND/FIN on this tunnel.
 const WriteTimeout = 30 * time.Second
 
 var (