[refactor] adopt yamux-only tunnel transport [BREAK]

- replace gRPC/DTLS tunnel paths with TLS + yamux transport
- remove legacy protocol, protobuf, DTLS, and proxy implementations
- simplify server and client entrypoints around yamux
- update configuration, metrics, API, and architecture documentation
- add bidirectional yamux session tests
- verify with go test ./...

internal/tunnel/types.go

@@ -0,0 +1,17 @@
+package tunnel
+
+import "context"
+
+// DomainValidator validates the client credentials presented on the control stream.
+type DomainValidator interface {
+	ValidateDomainAPIKey(ctx context.Context, domain, clientAPIKey string) error
+}
+
+// Response is the response returned by a tunnel transport to the public HTTP ingress.
+type Response struct {
+	RequestID string
+	Status    int
+	Header    map[string][]string
+	Body      []byte
+	Error     string
+}