feat(tunnel): switch to yamux stream proxying and connection pooling

- Introduce pooled tunnel sessions (TunnelID/DataConnect) on client/server
- Proxy HTTP/HTTPS via raw HTTP over yamux streams; pipe TCP streams directly
- Move UI/stats into internal/shared; refactor CLI tunnel helpers; drop msgpack/hpack legacy

internal/shared/protocol/safe_frame.go

@@ -4,20 +4,11 @@ import (
 	"sync"
 )
 
-// SafeFrame wraps Frame with automatic resource cleanup
 type SafeFrame struct {
 	*Frame
 	once sync.Once
 }
 
-// NewSafeFrame creates a SafeFrame that implements io.Closer
-func NewSafeFrame(frameType FrameType, payload []byte) *SafeFrame {
-	return &SafeFrame{
-		Frame: NewFrame(frameType, payload),
-	}
-}
-
-// Close implements io.Closer, ensures Release is called exactly once
 func (sf *SafeFrame) Close() error {
 	sf.once.Do(func() {
 		if sf.Frame != nil {
@@ -27,14 +18,6 @@ func (sf *SafeFrame) Close() error {
 	return nil
 }
 
-// WithFrame wraps an existing Frame with automatic cleanup
 func WithFrame(frame *Frame) *SafeFrame {
 	return &SafeFrame{Frame: frame}
 }
-
-// MustClose is a helper that calls Close and panics on error (for defer cleanup)
-func (sf *SafeFrame) MustClose() {
-	if err := sf.Close(); err != nil {
-		panic(err)
-	}
-}