refactor: modularize codebase — deduplicate, extract, clean up

- Unify duplicate uTLS transports into shared internal/transport package
- Extract shared version constant into internal/version
- Move LoadDefaultCredentials from config to auth (remove config→auth import)
- Deduplicate handler.go: extract telemetry/error helpers (324→268 lines)
- Break up main.go::run() into initCredential/initEmbedded
- Eliminate logging.Config duplication (use config.LoggingConfig directly)
- Extract logWriter to embedded/log.go, SSE fixtures to consts in sniff.go
- Use uTLS client for usage polling (consistent TLS fingerprint)
- Handle sjson.SetBytes errors in sanitize.go instead of silently swallowing
- Document reverse-engineered magic values in billing.go
- Unexport Credential.CooldownUntil (internal state)
- Replace hardcoded auth bypass paths with map in server.go

internal/auth/selector_test.go

@@ -80,7 +80,7 @@ func TestPool_Pick_RoundRobin(t *testing.T) {
 func TestPool_Pick_SkipsCooldown(t *testing.T) {
 	creds := []*Credential{
 		{ID: "a"},
-		{ID: "b", CooldownUntil: time.Now().Add(1 * time.Hour)},
+		{ID: "b", cooldownUntil: time.Now().Add(1 * time.Hour)},
 		{ID: "c"},
 	}
 	p := NewPool(creds)
@@ -116,8 +116,8 @@ func TestPool_Pick_SkipsCooldown(t *testing.T) {
 func TestPool_Pick_AllOnCooldown(t *testing.T) {
 	future := time.Now().Add(1 * time.Hour)
 	creds := []*Credential{
-		{ID: "a", CooldownUntil: future},
-		{ID: "b", CooldownUntil: future},
+		{ID: "a", cooldownUntil: future},
+		{ID: "b", cooldownUntil: future},
 	}
 	p := NewPool(creds)
 
@@ -203,13 +203,13 @@ func TestPool_MarkFailure(t *testing.T) {
 				}
 				// Verify approximate duration
 				cred.mu.Lock()
-				cooldownEnd := cred.CooldownUntil
+				cooldownEnd := cred.cooldownUntil
 				cred.mu.Unlock()
 
 				lower := before.Add(tt.expectedDur)
 				upper := time.Now().Add(tt.expectedDur)
 				if cooldownEnd.Before(lower) || cooldownEnd.After(upper) {
-					t.Errorf("CooldownUntil %v not in expected range [%v, %v]", cooldownEnd, lower, upper)
+					t.Errorf("cooldownUntil %v not in expected range [%v, %v]", cooldownEnd, lower, upper)
 				}
 			} else {
 				if cred.IsOnCooldown() {
@@ -223,7 +223,7 @@ func TestPool_MarkFailure(t *testing.T) {
 func TestPool_MarkSuccess(t *testing.T) {
 	cred := &Credential{
 		ID:            "test",
-		CooldownUntil: time.Now().Add(1 * time.Hour),
+		cooldownUntil: time.Now().Add(1 * time.Hour),
 	}
 	p := NewPool([]*Credential{cred})
 
@@ -282,7 +282,7 @@ func TestPool_RoundRobinCursorAdvancement(t *testing.T) {
 func TestPool_RoundRobinWithCooldownSkip(t *testing.T) {
 	creds := []*Credential{
 		{ID: "0"},
-		{ID: "1", CooldownUntil: time.Now().Add(1 * time.Hour)},
+		{ID: "1", cooldownUntil: time.Now().Add(1 * time.Hour)},
 		{ID: "2"},
 	}
 	p := NewPool(creds)