fix: support secured multi-secret handshakes and warm DC routing

[AndreyOsipuk]

Summary

• classify secured (dd) handshakes before FakeTLS parsing;
• preserve/replay handshake bytes during protocol detection and mask-host fallback;
• match multiple configured secrets for secured handshakes;
• bypass FakeTLS/doppelganger for secured sessions;
• add a bounded warm Telegram DC pool to absorb route/backoff flaps;
• keep compatibility with existing FakeTLS (ee) clients.

Validation

• targeted unit tests for obfuscation, anti-replay, connection rewind, and DC pool pass;
• full suite reaches only existing external-network failures in httpbin-backed tests (mtglib/TestHTTPSRequest, network/TestRealHTTPRequest).

The production binary built from this branch is deployed to the mtg nodes behind pr5–pr8 relays. DD response shaping remains disabled in production because Android connectivity is faster and stable without the experimental fragmentation layer.