fix(tuic): bound one client's connections and UDP relays

The UDP association cap applied per QUIC connection, and nothing limited
how many connections one credential could authenticate, so a single
client could hold enough UDP relays (each a host port) to exhaust the
host's ephemeral range. A client now gets at most 32 connections and 512
open UDP relays across all of them; past that a connection is refused at
authentication and a relay is not opened.

internal/tuic/socks_bridge.go

@@ -180,6 +180,8 @@ type SocksUDPSession struct {
 	targetEP net.Addr
 	user     string
 	closed   atomic.Bool
+	// onClose runs once when the session closes, releasing its place in a budget.
+	onClose func()
 }
 
 // DialUDP establishes a SOCKS5 UDP ASSOCIATE tunnel to Xray.
@@ -312,6 +314,9 @@ func (s *SocksUDPSession) Close() error {
 	if s.closed.Swap(true) {
 		return nil
 	}
+	if s.onClose != nil {
+		s.onClose()
+	}
 	_ = s.udpConn.Close()
 	return s.ctrl.Close()
 }