fix: eliminate unsafe code in packet construction and stats counters

Replace all UnsafeCell-based counters with safe alternatives:

- New ShardedCounter: per-thread TLS accumulation (thread_local crate)
  with periodic publish to static AtomicU64. Zero atomic RMW on hot path.
- ACL RuleStatsTracker: remove unsafe Arc<RuleStats> raw pointer
  mutation, use two ShardedCounter fields.
- ZCPacket: replace set_len on uninitialized BytesMut with
  write_bytes + copy_nonoverlapping before set_len.
- StatsManager UnsafeCounter/MetricData: remove UnsafeCell and
  unsafe impl Send/Sync, wrap ShardedCounter. last_updated uses
  AtomicU64 epoch millis.
- Throughput: replace UnsafeCell with AtomicU64.
- secure_datagram: fix grace-window test timestamp.

easytier/Cargo.toml

@@ -224,6 +224,7 @@ smoltcp = { git = "https://github.com/smoltcp-rs/smoltcp.git", rev = "0a926767a6
     "async",
 ] }
 parking_lot = { version = "0.12.0" }
+thread_local = "1.1"
 
 wildmatch = "2.3.4"
 
@@ -344,7 +345,7 @@ zip = "4.0.0"
 
 
 [dev-dependencies]
-criterion = "0.5.1"
+criterion = { version = "0.5", features = ["html_reports"] }
 serial_test = "3.0.0"
 rstest = "0.25.0"
 futures-util = "0.3.31"
@@ -352,6 +353,14 @@ maplit = "1.0.2"
 tempfile = "3.22.0"
 ctor = "0.8.0"
 
+[[bench]]
+name = "acl_hotpath"
+harness = false
+
+[[bench]]
+name = "zc_packet"
+harness = false
+
 [target.'cfg(target_os = "linux")'.dev-dependencies]
 defguard_wireguard_rs = "0.4.2"
 tokio-socks = "0.5.2"