refactor(mpc-tls): unify client and mpc

[th4s]

Summary

Fuses the forked-rustls TLS client with the MPC protocol into one coherent
connection, removing the State trait, the Deref hack, the backend facade,
and the duplicated leader/follower setup. Behaviour and the leader↔follower wire
protocol are unchanged.

Motivation

The crate ran two overlapping state machines on the leader (a boxed dyn State
handshake SM and a separate Init→…→Closed enum), reached the MPC through an
opaque backend field on CommonState, leaned on a ClientConnection: Deref<CommonState>
hack, and kept shared setup as free functions in utils.rs.

Key changes

• MpcSession (session.rs): shared MPC core (key exchange, PRF, record
  layer, VM, ctx) embedded by both leader and follower. Absorbs the utils.rs
  free functions and de-duplicates setup/key-derivation.
• Conn / TlsIo (conn.rs): the live connection — TLS framing (TlsIo)
  plus the MpcSession — owning the session directly. Replaces CommonState
  and the backend facade.
• MpcTlsLeader (leader.rs): the single public type. Internal Setup → Live
  lifecycle; Live drives a Phase that is Handshaking (state machine + inputs)
  or Online (traffic), flipping in place when the handshake completes. Deref
  hack removed.
• handshake module (renamed from client): the handshake state machine
  (hs/tls12/tls13), the online router (traffic), and TLS-client policy
  (config, cert verification, signing). The boxed dyn State trait is replaced
  by a closed Handshake enum; public types are re-exported at the crate root
  (mpc_tls::ClientConfig, …).
• TLS 1.3 handling is retained (dormant) and wired into the new state machine.