Feat: One-way TLS transport for the MFC server

Add optional one-way TLS to the MFC server (server/2015Remote) so the device
port can serve both TLS clients and legacy plaintext clients on the same port,
mirroring the Go server.

Server: on a connection's first bytes, sniff for a TLS ClientHello (0x16 0x03
+ handshake type 0x01). When [tls] Enabled=1 and the identity loads, hand the
socket to a short-lived blocking handshake thread (Option A) running Schannel
AcceptSecurityContext, then decrypt on recv and encrypt on send; plaintext
connections replay the sniffed bytes straight into the existing parse path, so
the plaintext code path is otherwise unchanged. The identity is loaded once
from [tls] CertPath/KeyPath as PEM + CNG (PKCS#8) — the same key pair the Go
server uses — and a missing [tls] section, an empty value, or a load failure
leaves plaintext serving intact and fail-closes any TLS ClientHello.

Also fix two transport-reliability bugs that surfaced end-to-end:
- send path: encrypt only the freshly appended plaintext tail and post a
  single IOWrite wake-up guarded by a bSendPending flag, so back-to-back small
  sends (terminal resize -> COMMAND_NEXT -> resize) no longer run concurrent
  WSASends over the same mutable buffer (client saw DecryptMessage failures,
  with WSAGetLastError() = 6001 / ERROR_DECRYPTION_FAILED);
- client Recv: keep the handshake's unconsumed tail bytes in m_raw and drain
  them before the next recv, and log the real SECURITY_STATUS on
  DecryptMessage failure instead of the stale Winsock error.

Co-Authored-By: deepseek-v4-pro

client/TlsChannel.h

@@ -60,8 +60,14 @@ public:
     // 前缀字节数（>0）或 SOCKET_ERROR（一个字节都没发出去时）。
     int  Send(SOCKET sock, const char* buf, int len);
 
-    // 是否有已解密但尚未交付给应用层的明文（供接收线程在 select 前优先消费）。
-    bool HasPending() const { return !m_pending.empty(); }
+    // 是否有待交付的数据：已解密明文（m_pending）或已缓冲但尚未解密的 TLS 记录（m_raw）。
+    // 供接收线程在 select 前优先消费——select 只看底层 socket，看不到 Schannel 缓冲的
+    // m_raw（握手时随 Finished 收下的首条应用数据、或一次 recv 到多条记录后的剩余），
+    // 若这里不把 m_raw 也算作「有数据」，这些字节会被 select 卡住。
+    bool HasPending() const { return !m_pending.empty() || !m_raw.empty(); }
+
+    // 握手是否已完成（Send/Recv 可用）。诊断用：区分「本连接已走 TLS」与「裸连接」。
+    bool IsReady() const { return m_ready; }
 
 private:
     void CloseHandles();