Replace per-SOCKS-request HTTPS connections with persistent multiplexed tunnel session

- Introduce TunnelSession that holds a single authenticated SendRequest
  shared across all concurrent SOCKS5 streams via Arc<Mutex<>>
- Connector authenticates once on startup, then reuses the persistent
  tunnel for all SOCKS5 CONNECT requests
- Listener /forward returns raw bytes (no HTTP parse/unparse overhead)
  to preserve exact byte semantics for SOCKS5 TCP proxying
- Add stream counters (session-X) for logging and isolation tracking
- Add 5 new tests: sequential streams, concurrent streams with isolation,
  stream counter increments, pre-auth rejection, and E2E concurrent SOCKS5
  streams over a shared tunnel
- All 117 tests pass; E2E CLI validates 5 concurrent streams share one
  persistent TLS connection (127.0.0.1:64216 in transcript)

src/errors.rs

@@ -40,6 +40,9 @@ pub enum AuthError {
     #[error("auth token invalid")]
     Invalid,
 
+    #[error("auth not yet completed")]
+    NotAuthenticated,
+
     #[error("auth token expired")]
     #[allow(dead_code)]
     Expired,