break: replace muxed workers with 1:1 tunnels

Worker frames are now FrameType + payload; there is no stream id.
Each player gets its own worker conn. maxTunnels (default 256)
caps concurrent tunnels. The old maxConn pool size is ignored so
existing configs do not silently admit only a handful of players.

Resume, per-direction windows, the control session, and the
DATA-only shaper stay. A dropped worker still hangs that one
player and reattaches over a fresh conn.

Add a hub-side per-IP limiter for player intents only (default
8/s, burst 16, 64 concurrent). Unmatched hostnames consume a
token; Intent 17 is never counted. 0 disables each knob.

e2e/bandwidth_test.go

@@ -14,12 +14,12 @@ import (
 // startClientWithBandwidth is startClient with an egress cap, for the shaping
 // tests. Only the client→hub direction is shaped, which in this harness is the
 // leg carrying the mock destination's echo back to the player.
-func startClientWithBandwidth(t *testing.T, hubAddr, psk string, maxConn int, bandwidth string, mappings []client.Mapping) *client.Client {
+func startClientWithBandwidth(t *testing.T, hubAddr, psk string, maxTunnels int, bandwidth string, mappings []client.Mapping) *client.Client {
 	t.Helper()
 	cfg := &client.Config{
 		Server:         hubAddr,
 		PSK:            psk,
-		MaxConn:        maxConn,
+		MaxTunnels:     maxTunnels,
 		PingIntervalMs: 20000,
 		MaxBandwidth:   bandwidth,
 		Mappings:       mappings,
@@ -104,9 +104,9 @@ func TestCappedBandwidthDoesNotStarveLightStreams(t *testing.T) {
 	hubAddr := fmt.Sprintf("127.0.0.1:%d", port)
 	startHub(t, port, psk)
 	dest := newMockDest(t, modeEcho)
-	// maxConn=1 forces every stream onto one worker conn, so nothing but the
-	// shaper is deciding who gets the link.
-	startClientWithBandwidth(t, hubAddr, psk, 1, "1MB/s", []client.Mapping{
+	// Each player has its own worker conn; the shaper is still the only thing
+	// splitting the shared uplink budget.
+	startClientWithBandwidth(t, hubAddr, psk, 4, "1MB/s", []client.Mapping{
 		{Pattern: "mc.local", Destination: dest.addr},
 	})