Add the C++ TCP relay engine and run ss-tunnel on it

One engine (src/relay/tcp) for the four TCP relays: connections live in a
fixed pool owned through PoolPtr, handshake, cipher state and buffers are
inline, timeouts are intrusive deadline lists on one timer and DNS answers
come back through generation-checked handles. A full pool refuses new
connections and pauses accepting until a slot frees.

ss-tunnel is the first user; its hand-written relay callbacks are gone.
tests/tunnel_interop.py covers every method against ss-server and
shadowsocks-rust.

scripts/no_heap_baseline.txt

@@ -19,6 +19,6 @@ src/server.cpp 17
 src/ss_event.cpp 5
 src/ssurl.cpp 3
 src/stream.cpp 3
-src/tunnel.cpp 14
+src/tunnel.cpp 2
 src/udprelay.cpp 7
 src/utils.cpp 10