fix(tunnel): wait for WS before accepting TCP — prevents startup burst

On fresh start/restart, Telegram clients immediately flood with TCP
connections. Without WS ready, all get dropped or burst-connect to
Worker causing CPU exceeded. Now waits up to 10s for first WS before
accepting TCP. Result: 0 drops on startup vs dozens before.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mtproxy-client/tunnel.go

@@ -519,6 +519,18 @@ func runTunnel() error {
 
 	go tc.run()
 
+	// Wait for first WS connection before accepting TCP — prevents burst
+	// of connections hitting a not-yet-ready Worker
+	for i := 0; i < 100; i++ {
+		tc.mu.Lock()
+		w := tc.writer
+		tc.mu.Unlock()
+		if w != nil {
+			break
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+
 	go func() {
 		<-ctx.Done()
 		log.Println("[tunnel] shutting down...")