refactor(core): use linearizable lazy token bucket (#2421)

Replace periodic refill tasks with on-demand accounting to avoid waking
idle token buckets.

Keep balance, refill time, and fractional credit in one locked state so
concurrent consumers cannot observe partially published refills or
exceed the configured burst capacity. Track credit in nanoseconds and
discard excess credit at capacity to preserve precise limiter behavior.

Use a one-second default burst capacity to preserve the existing
limiter behavior while supporting explicit capacity configuration. Keep
limiter capacity and fill rate in a local config instead of an unused
protobuf message.

Charge only logical EasyTier data payload, unwrap foreign network
packets before accounting, and leave control traffic outside the
limiter. Reject forged payload lengths by accounting from actual packet
boundaries.

Split oversized blocking consumes into capacity-sized chunks and cover
concurrency, refill precision, burst caps, payload accounting, and
bandwidth integration behavior.

easytier-proto/proto/common.proto

@@ -250,14 +250,6 @@ message PortForwardConfigPb {
 
 message ProxyDstInfo { SocketAddr dst_addr = 1; }
 
-message LimiterConfig {
-  optional uint64 burst_rate =
-      1; // default 1 means no burst (capacity is same with bps)
-  optional uint64 bps = 2; // default 0 means no limit (unit is B/s)
-  optional uint64 fill_duration_ms =
-      3; // default 10ms, the period to fill the bucket
-}
-
 message SecureModeConfig {
   bool enabled = 1;