feat: --stats-allow-net CIDR for custom stats access ranges

Overlay networks (Tailscale, Netbird, WireGuard) use non-RFC1918 ranges
like 100.64.0.0/10 that is_private_ip() rejects. Add a repeatable flag
to extend the stats endpoint allowlist with specific CIDR ranges, reusing
the existing parser from net-ip-acl.c.

Closes #4

docs: add v3.5.4 changelog entry

docs: add v3.5.3 changelog entry

fix: limit DRS delays to slow-start phases, add media download E2E te…

…sts (#70)

DRS inter-record delays still throttled sustained downloads in v3.5.1 —
the burst threshold (16KB) fired at batch boundaries during streaming.
Now delays only apply during phases 1+2 (first ~60 records, ~140KB).
Phase 3 (max-size records) runs at full TCP speed. The DRS counter
resets after 1s inactivity so new responses still get realistic timing.

Tests:
- Multi-size media download E2E (1/20/100 MB) through obfs2 and
  fake-TLS with SHA256 integrity checks and throughput assertions
- DRS bulk transfer delay bounds test (Docker)
- Relative throughput check: fake-TLS >= 50% of obfs2
- CI concurrency to cancel stale runs
- Auth key retry with backoff for flaky sessions

fix: skip DRS inter-record delays during bulk transfers (#70)

DRS delays (Weibull, ~7ms mean) were applied after every TLS record,
throttling large file downloads to ~2 MB/s. Now delays are automatically
skipped when the output buffer exceeds one max-size TLS record (16 KB),
restoring full TCP throughput for bulk transfers while preserving
anti-fingerprinting delays for small responses.

New stat: drs_delays_skipped / mtproxy_drs_delays_skipped_total

fix: move release Telegram notification into release workflow

GitHub Actions events created by GITHUB_TOKEN don't trigger other
workflows, so the release.published event never fired telegram-notify.
Move the notification directly into release.yml and remove the dead
release trigger from telegram-notify.yml.

feat: add per-secret connection limits (#66)

Cap concurrent connections per secret to prevent a leaked secret from
consuming all proxy resources. When the limit is reached, new TLS
connections are proxied to the configured domain (indistinguishable from
a normal website), and obfuscated2 connections are silently dropped.
Existing connections and other secrets are unaffected.

- CLI: -S secret:label:1000 (limit is optional, backward-compatible)
- Docker: SECRET_LIMIT_N env vars
- Stats: secret_<label>_limit, secret_<label>_rejected
- Prometheus: mtproxy_secret_connection_limit, mtproxy_secret_connections_rejected_total
- Multi-worker: limit divided across workers for approximate enforcement

Closes #66

v3.3.1 — untrack CLAUDE.md

v3.3.0 — Static binaries, secret labels, direct-mode fixes

v3.1.0: Direct-to-DC, Prometheus, ARM64, IP ACL, Alpine Docker