Feature: sub-connection auth (TOKEN_CONN_AUTH) with HMAC + clientID binding

Client first packet on every sub-connection signs (clientID || timestamp ||
nonce) and waits for server ack. Server verifies signature and pins clientID
on the sub-connection ctx, eliminating IP-reverse-lookup unreliability for
NAT/localhost scenarios. Sub-conn coverage: Win 12 sites, Linux/macOS 3-4
each. Main connection keeps existing TOKEN_LOGIN flow unchanged.

Includes:
- Protocol structs sized to 512/256 bytes with reserved space for future
  extensions (locale, OS info, session token, etc.)
- 5-min timestamp tolerance (Kerberos-grade replay window)
- 10-sec client wait for cross-pacific / weak-network tolerance
- Fix RemoveFromHostList side-effect ordering: MarkDeviceOffline and
  m_ActiveWndW.erase now only fire when ctx is actually removed from
  m_HostList, preventing sub-conn disconnects from misreporting main as
  offline (regression introduced by auth-set clientID on sub ctx)
- Fix latent bug: IOCPClient::m_conn was never assigned in ctor, leaving
  GetConnectionAddress() always NULL and FileManager V2 transfer's
  srcClientID always 0

Breaking change: new client cannot use sub-features against old server.
New server tolerates legacy clients (no auth). Future tightening can reject
unauthenticated sub-connections via IsAuthenticated() flag.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/2015Remote/Server.h

@@ -378,6 +378,11 @@ public:
     std::atomic<int>    IoRefCount{0};              // I/O 处理引用计数
     std::atomic<bool>   IsRemoved{false};           // 标记是否已被标记为移除
 
+    // 子连接身份校验：客户端发 TOKEN_CONN_AUTH 通过验证后置位。
+    // 主连接（走 TOKEN_LOGIN 流程）不参与此机制。当前阶段宽容（未通过也接受），
+    // 仅作为标记供后续命令处理 / 未来收紧策略使用。
+    std::atomic<bool>   m_bAuthenticated{false};
+
     // 预分配的解压缩缓冲区，避免频繁内存分配
     PBYTE               DecompressBuffer = nullptr;
     ULONG               DecompressBufferSize = 0;
@@ -510,7 +515,11 @@ public:
         // 注意：到达这里时，RemoveStaleContext 应该已经等待 IoRefCount==0
         IsRemoved.store(false, std::memory_order_release);
         IoRefCount.store(0, std::memory_order_release);
+        // 复用对象池时清空校验状态
+        m_bAuthenticated.store(false, std::memory_order_release);
     }
+    void SetAuthenticated(bool v) { m_bAuthenticated.store(v, std::memory_order_release); }
+    bool IsAuthenticated() const  { return m_bAuthenticated.load(std::memory_order_acquire); }
     uint64_t GetAliveTime()const
     {
         return time(0) - OnlineTime;