et@0.0.2

Fix reconnect against upstream C++ peers rejecting the session with "invalid recovery proof" (ad30f8b)

Reconnecting to an upstream C++ etserver (or accepting an upstream C++ et
client) failed with server sent an invalid recovery proof whenever the peer's
first packet after recovery was regular session traffic, such as terminal
output. et.rs required the first post-recovery packet to be an empty
keep-alive, a convention upstream does not follow.

Recovery authentication now accepts any packet that decrypts with the session
key (which is the actual proof) and requeues it for the session loop instead
of discarding it, so no traffic is lost.

Also fixes a port-forwarding race surfaced by this change: closing a forwarded
socket could drop data still queued for its writer thread. Teardown now drains
queued writes before shutting the socket down.