Feat: One-way TLS transport for the MFC server

Add optional one-way TLS to the MFC server (server/2015Remote) so the device
port can serve both TLS clients and legacy plaintext clients on the same port,
mirroring the Go server.

Server: on a connection's first bytes, sniff for a TLS ClientHello (0x16 0x03
+ handshake type 0x01). When [tls] Enabled=1 and the identity loads, hand the
socket to a short-lived blocking handshake thread (Option A) running Schannel
AcceptSecurityContext, then decrypt on recv and encrypt on send; plaintext
connections replay the sniffed bytes straight into the existing parse path, so
the plaintext code path is otherwise unchanged. The identity is loaded once
from [tls] CertPath/KeyPath as PEM + CNG (PKCS#8) — the same key pair the Go
server uses — and a missing [tls] section, an empty value, or a load failure
leaves plaintext serving intact and fail-closes any TLS ClientHello.

Also fix two transport-reliability bugs that surfaced end-to-end:
- send path: encrypt only the freshly appended plaintext tail and post a
  single IOWrite wake-up guarded by a bSendPending flag, so back-to-back small
  sends (terminal resize -> COMMAND_NEXT -> resize) no longer run concurrent
  WSASends over the same mutable buffer (client saw DecryptMessage failures,
  with WSAGetLastError() = 6001 / ERROR_DECRYPTION_FAILED);
- client Recv: keep the handshake's unconsumed tail bytes in m_raw and drain
  them before the next recv, and log the real SECURITY_STATUS on
  DecryptMessage failure instead of the stale Winsock error.

Co-Authored-By: deepseek-v4-pro

server/2015Remote/2015Remote_vs2015.vcxproj

@@ -350,6 +350,7 @@
     <ClInclude Include="ScreenSpyDlg.h" />
     <ClInclude Include="SearchBarDlg.h" />
     <ClInclude Include="Server.h" />
+    <ClInclude Include="ServerTlsSession.h" />
     <ClInclude Include="ServicesDlg.h" />
     <ClInclude Include="ConnectionsDlg.h" />
     <ClInclude Include="SettingDlg.h" />
@@ -457,6 +458,7 @@
     <ClCompile Include="ZstaPickerDlg.cpp" />
     <ClCompile Include="IOCPKCPServer.cpp" />
     <ClCompile Include="IOCPServer.cpp" />
+    <ClCompile Include="ServerTlsSession.cpp" />
     <ClCompile Include="IOCPUDPServer.cpp" />
     <ClCompile Include="IPHistoryDlg.cpp" />
     <ClCompile Include="KeyBoardDlg.cpp" />