Feat: One-way TLS transport for the MFC server

Add optional one-way TLS to the MFC server (server/2015Remote) so the device
port can serve both TLS clients and legacy plaintext clients on the same port,
mirroring the Go server.

Server: on a connection's first bytes, sniff for a TLS ClientHello (0x16 0x03
+ handshake type 0x01). When [tls] Enabled=1 and the identity loads, hand the
socket to a short-lived blocking handshake thread (Option A) running Schannel
AcceptSecurityContext, then decrypt on recv and encrypt on send; plaintext
connections replay the sniffed bytes straight into the existing parse path, so
the plaintext code path is otherwise unchanged. The identity is loaded once
from [tls] CertPath/KeyPath as PEM + CNG (PKCS#8) — the same key pair the Go
server uses — and a missing [tls] section, an empty value, or a load failure
leaves plaintext serving intact and fail-closes any TLS ClientHello.

Also fix two transport-reliability bugs that surfaced end-to-end:
- send path: encrypt only the freshly appended plaintext tail and post a
  single IOWrite wake-up guarded by a bSendPending flag, so back-to-back small
  sends (terminal resize -> COMMAND_NEXT -> resize) no longer run concurrent
  WSASends over the same mutable buffer (client saw DecryptMessage failures,
  with WSAGetLastError() = 6001 / ERROR_DECRYPTION_FAILED);
- client Recv: keep the handshake's unconsumed tail bytes in m_raw and drain
  them before the next recv, and log the real SECURITY_STATUS on
  DecryptMessage failure instead of the stale Winsock error.

Co-Authored-By: deepseek-v4-pro

server/2015Remote/Buffer.cpp

@@ -337,3 +337,20 @@ VOID CBuffer::CommitWrite(ULONG writtenSize)
     m_Ptr += writtenSize;
     LeaveCriticalSection(&m_cs);
 }
+
+// 截断缓冲区到指定有效长度（仅回退写指针，不移动/释放底层内存）。有效长度指「当前读取
+// 位置之后的字节数」，与 GetBufferLength 一致；请求值超出现有有效长度时收敛到现有长度。
+VOID CBuffer::TruncateBuffer(ULONG effectiveLen)
+{
+    EnterCriticalSection(&m_cs);
+    if (m_Base == NULL) {
+        LeaveCriticalSection(&m_cs);
+        return;
+    }
+    ULONG totalDataLen = (ULONG)(m_Ptr - m_Base);
+    ULONG cur = (totalDataLen > m_ulReadOffset) ? (totalDataLen - m_ulReadOffset) : 0;
+    if (effectiveLen > cur)
+        effectiveLen = cur;
+    m_Ptr = m_Base + m_ulReadOffset + effectiveLen;
+    LeaveCriticalSection(&m_cs);
+}