feat: add extensible direct forwarding and selectable connection direction

[dr-hoseyn]

Summary

This PR adds a production-oriented Direct connection path while preserving the existing Reverse behavior and configuration compatibility.

• introduces an extensible engine registry with Reverse as the legacy/default engine
• adds a dual-stack iptables direct-forward engine with validation, ownership-safe generations, rollback, health, cleanup, conflict detection, and persistent counters
• lets users choose Direct or Reverse after selecting any supported transport; Direct means the Iran edge initiates the selected transport toward Kharej
• keeps existing reverse transports and /api/tunnels behavior compatible while adding mode, engine, mapping, health, and general instance metrics
• extends CLI, management, Telegram, backup/restore, diagnostics, watchdog, and monitoring views for Direct instances
• hardens Direct TCP/Stealth under load with a bounded pre-warmed connection pool and generation-scoped reconnect lifecycle

Compatibility

• configs without engine still run as Reverse without migration
• engine is the only persisted source of truth; mode is derived metadata
• Reverse networking behavior and existing tunnel metrics remain intact
• API changes are additive
• Direct instances are excluded from reverse-only benchmark, relay-selection, link-test, and connected-peer logic

Reliability and safety

• validates invalid engine/section combinations before system changes
• applies instance-owned iptables generations transactionally and rolls back cross-family failures
• uses deterministic instance ownership, structured comments, a global netfilter lock, and fail-closed conflict analysis
• scrapes and persists counters before rebuild/cleanup and reconciles generations after an unclean exit
• prevents stale client generations from restarting or publishing into their replacement
• closes idle relays promptly on cancellation and bounds concurrent Direct TCP/Stealth handshakes

Validation performed

• go vet ./...
• Linux amd64 compilation of all 32 packages and final binary build
• complete Linux unit and E2E suites
• Direct stream E2E across TCP, Stealth, TCPMux, KCP, QUIC, WS, WSS, WSMux, and WSSMux
• Direct UDP E2E
• 64 simultaneous Direct connections on TCP and Stealth
• 16 MiB integrity transfers in Direct and Reverse modes on TCP and Stealth
• origin restart/reconnect recovery on TCP and Stealth using the same ingress port (regression coverage for address already in use)
• IPv4/IPv6, rollback, ownership, counters, conflict detection, backup/restore, metrics, drift, and legacy configuration tests
• manual two-host Direct and Reverse validation on Linux VPS environments

Review notes

The branch has been merged with the latest main (including the current BPF/WireGuard spoof changes) and the affected suites plus the complete E2E suite were rerun after that merge.