break: replace muxed workers with 1:1 tunnels

Worker frames are now FrameType + payload; there is no stream id.
Each player gets its own worker conn. maxTunnels (default 256)
caps concurrent tunnels. The old maxConn pool size is ignored so
existing configs do not silently admit only a handful of players.

Resume, per-direction windows, the control session, and the
DATA-only shaper stay. A dropped worker still hangs that one
player and reattaches over a fresh conn.

Add a hub-side per-IP limiter for player intents only (default
8/s, burst 16, 64 concurrent). Unmatched hostnames consume a
token; Intent 17 is never counted. 0 disables each knob.

e2e/resume_test.go

@@ -131,10 +131,9 @@ func TestResumePreservesByteStream(t *testing.T) {
 }
 
 // TestResumeWithConcurrentStreams covers the failure the single-stream test
-// cannot reach: stream ids restart at 1 on every conn, so after a reattach two
-// players can hold the same id on different conns. A binding that updates the
-// conn and the id separately will credit or reset the wrong player's stream, and
-// that only shows up when a second stream is there to be corrupted.
+// cannot reach: two independent tunnels resume at once. A torn rebind that
+// writes a frame onto the wrong conn would credit or reset the other player's
+// tunnel, and that only shows up when a second player is there to be corrupted.
 func TestResumeWithConcurrentStreams(t *testing.T) {
 	const psk = "e2e-resume-multi"
 	hubPort := freePort(t)
@@ -143,7 +142,7 @@ func TestResumeWithConcurrentStreams(t *testing.T) {
 	dest := newMockDest(t, modeEcho)
 
 	relay := newBlackholeRelay(t, hubAddr)
-	startClientWithPing(t, relay.addr, psk, 2, 400, []client.Mapping{
+	startClientWithPing(t, relay.addr, psk, 4, 400, []client.Mapping{
 		{Pattern: "mc.local", Destination: dest.addr},
 	})
 
@@ -197,7 +196,7 @@ func TestResumeDisabledClosesImmediately(t *testing.T) {
 	startClientCfg(t, &client.Config{
 		Server:         relay.addr,
 		PSK:            psk,
-		MaxConn:        1,
+		MaxTunnels:     1,
 		PingIntervalMs: 400,
 		StreamResume:   &off,
 		Mappings:       []client.Mapping{{Pattern: "mc.local", Destination: dest.addr}},
@@ -237,7 +236,7 @@ func TestResumeGraceExpiryClosesPlayer(t *testing.T) {
 	startClientCfg(t, &client.Config{
 		Server:         relay.addr,
 		PSK:            psk,
-		MaxConn:        1,
+		MaxTunnels:     1,
 		PingIntervalMs: 400,
 		ResumeGraceMs:  2000,
 		Mappings:       []client.Mapping{{Pattern: "mc.local", Destination: dest.addr}},