refactor: modularize codebase — deduplicate, extract, clean up

- Unify duplicate uTLS transports into shared internal/transport package
- Extract shared version constant into internal/version
- Move LoadDefaultCredentials from config to auth (remove config→auth import)
- Deduplicate handler.go: extract telemetry/error helpers (324→268 lines)
- Break up main.go::run() into initCredential/initEmbedded
- Eliminate logging.Config duplication (use config.LoggingConfig directly)
- Extract logWriter to embedded/log.go, SSE fixtures to consts in sniff.go
- Use uTLS client for usage polling (consistent TLS fingerprint)
- Handle sjson.SetBytes errors in sanitize.go instead of silently swallowing
- Document reverse-engineered magic values in billing.go
- Unexport Credential.CooldownUntil (internal state)
- Replace hardcoded auth bypass paths with map in server.go

internal/transport/utls_test.go

@@ -0,0 +1,78 @@
+package transport
+
+import (
+	"net/http"
+	"testing"
+	"time"
+)
+
+func TestNewUTLS(t *testing.T) {
+	tr := NewUTLS()
+	if tr == nil {
+		t.Fatal("NewUTLS returned nil")
+	}
+	if tr.connections == nil {
+		t.Error("connections map is nil")
+	}
+	if tr.pending == nil {
+		t.Error("pending map is nil")
+	}
+	if tr.dialTimeout != 10*time.Second {
+		t.Errorf("dialTimeout = %v, want 10s", tr.dialTimeout)
+	}
+}
+
+func TestNewHTTPClient(t *testing.T) {
+	tests := []struct {
+		name    string
+		timeout time.Duration
+	}{
+		{"zero timeout (streaming)", 0},
+		{"15s timeout", 15 * time.Second},
+		{"30s timeout", 30 * time.Second},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := NewHTTPClient(tt.timeout)
+			if c == nil {
+				t.Fatal("NewHTTPClient returned nil")
+			}
+			if c.Timeout != tt.timeout {
+				t.Errorf("Timeout = %v, want %v", c.Timeout, tt.timeout)
+			}
+			if c.Transport == nil {
+				t.Error("Transport is nil")
+			}
+			if _, ok := c.Transport.(*UTLS); !ok {
+				t.Errorf("Transport type = %T, want *UTLS", c.Transport)
+			}
+		})
+	}
+}
+
+func TestUTLS_ImplementsRoundTripper(t *testing.T) {
+	var _ http.RoundTripper = (*UTLS)(nil)
+}
+
+func TestUTLS_RoundTrip_InvalidHost(t *testing.T) {
+	tr := NewUTLS()
+	// Use a non-routable address to test dial timeout behavior
+	req, err := http.NewRequest("GET", "https://192.0.2.1:443/test", nil)
+	if err != nil {
+		t.Fatalf("NewRequest: %v", err)
+	}
+	_, err = tr.RoundTrip(req)
+	if err == nil {
+		t.Error("expected error for non-routable address, got nil")
+	}
+}
+
+func TestUTLS_ConnectionEviction(t *testing.T) {
+	tr := NewUTLS()
+	// Verify connections map starts empty
+	tr.mu.Lock()
+	if len(tr.connections) != 0 {
+		t.Errorf("initial connections = %d, want 0", len(tr.connections))
+	}
+	tr.mu.Unlock()
+}