Add multi-client support, WireGuard-only mode, and dynamic IP re-resolution

[RogerHartmann]

Add multi-client support, WireGuard-only mode, and dynamic IP re-resolution

• Multi-client support (--max-clients 1-10): each client gets its own dedicated send socket with a unique source port, enabling simultaneous sessions tracked by endpoint address. Inactive clients are cleaned up after CLIENT_TIMEOUT_SECONDS (30s).

• WireGuard-only mode (--wireguard-only): new clients are rejected unless their first packet is a valid WireGuard handshake initiation (type=1, reserved=0, exactly 148 bytes).

• Dynamic connect address re-resolution (--connect-resolve-interval N): periodically re-resolves --connect-host every N seconds (default 60, 0=disabled). Logs and updates the connect address if the IP changes, useful for servers with dynamic or failover DNS.

[RogerHartmann]

hello @danpodeanu
I did quite a few updates (with the help of claude) for my usecase. Feel free if you like to accept the pull request or not, just thought you might also have a usecase.
There would be still items to consider (e.g. the multi client support has an issue with fake clients that could block real clients), but it works quite well for my main use case to allow wireguard forwarding to my IPv6 only home network, when I am in a network that supports IPv4 only.

[RogerHartmann]

I did some more updates:

Add WireGuard no-reply timeout and roaming (type 4) support

This PR adds two related WireGuard improvements:

--wireguard-timeout
Drop clients that sent a WireGuard handshake init or transport data packet
but received no server reply within N seconds. Since WireGuard servers
silently ignore packets from unknown peers, without this the proxy holds
a dead session slot indefinitely.

Roaming support (type 4 transport data)
When a client switches networks mid-session it sends a type 4 (transport
data) packet from the new IP/port before re-initiating a handshake.
--wireguard-only now accepts both type 1 and type 4 packets from new
clients so roaming is not blocked.
--wireguard-timeout also applies to roaming type 4 sessions, covering
the case where the server no longer recognises the peer.

Version bumped to 2.3.1.