fix(tuic): bound one client's connections and UDP relays

The UDP association cap applied per QUIC connection, and nothing limited
how many connections one credential could authenticate, so a single
client could hold enough UDP relays (each a host port) to exhaust the
host's ephemeral range. A client now gets at most 32 connections and 512
open UDP relays across all of them; past that a connection is refused at
authentication and a relay is not opened.

internal/tuic/auth.go

@@ -17,6 +17,13 @@ var (
 	ErrInvalidTLSState = errors.New("tuic: TLS connection state not available")
 )
 
+// One credential's limits across all its connections: each UDP relay holds a host port, so
+// a per-connection cap alone lets one client take the host's whole ephemeral range.
+const (
+	maxUserSessions  = 32
+	maxUserUdpRelays = 512
+)
+
 // User represents a configured TUIC client for authentication and billing.
 type User struct {
 	TrafficID int
@@ -26,6 +33,8 @@ type User struct {
 	Email     string
 	Traffic   *UserTraffic
 	sessions  atomic.Int64
+	// udpRelays counts the open UDP relays over all the client's connections.
+	udpRelays atomic.Int64
 }
 
 type UserTraffic struct {