Issue #33 follow-ups: enum-based remotes, conn cap, UDP alloc, parser rewrite

[guyte149]

Closes #33.

Addresses every bullet from the follow-ups roll-up. Primarily an internal refactor; the only externally-visible additions are a new --max-connections flag and a wire-format version bump that requires client and server to upgrade together.

Summary

• Architecture / dispatch (Architecture: god-struct RemoteRequest, duplicated dispatch, weak abstractions #19 §1, §6 / Code quality: dead code, typos, missing tests, CI gap #22 §1). RemoteRequest is now { direction: Direction, kind: RemoteKind } where RemoteKind is Tcp { local, remote } | Udp { local, remote } | Socks5 { local }. The wire-level magic pair remote_host == "socks" && remote_port == 0 is gone. Dispatchers in src/server/mod.rs and src/client/mod.rs collapse to flat match (direction, &kind) with no _ placeholders and no string sentinels. Breaking wire change — version bumped to 0.4.0.
• Hardening (Security: no server cert verification, no auth, weak access controls #17 §3). New --max-connections N server flag. Backed by a tokio::sync::Semaphore whose permit is held for the lifetime of handle_client_connection; surplus connections are refused at the QUIC layer (Incoming::refuse()) rather than queued. 0 (default) keeps behaviour uncapped.
• UDP per-loop alloc (Performance: JSON control plane, per-loop allocations, no QUIC tuning #21 §3). tunnel_udp_client now uses mpsc::Sender<bytes::Bytes> fed from a rolling BytesMut pool: recv_from writes into the arena, split_to(n).freeze() hands a zero-copy frozen slice to the session task, and the underlying allocation reverts to the pool when outstanding handles drop.
• Parser rewrite (Performance: JSON control plane, per-loop allocations, no QUIC tuning #21 §5). RemoteRequest::from_str is layered now (parse_direction → parse_protocol → split_addr_tokens → tokens_to_kind) with per-arity helper fns. The 150-line nested match is gone. All 25 existing parser tests pass plus 3 new ones covering the new helper API.
• Lint policy (Security: no server cert verification, no auth, weak access controls #17 §4). Decision documented in Cargo.toml and CHANGELOG.md: not lifting clippy::expect_used / clippy::panic to deny. Would only force three #[allow] annotations on infallible-invariant call sites; not worth the noise without an explicit "production code never panics" goal.

Made with Cursor