Add curl installer and default Cloudflare ECH cover name

[madeye]

Adds a one-line curl installer that installs ech-tls-tunnel with shadowsocks-rust: client selects sslocal, and server selects ssserver. Downloads are verified against release SHA-256 checksums; Linux x86_64/ARM64 and macOS ARM64 are supported, with an optional install directory and pinned release tags.

Key generation and server configuration now default to cloudflare-ech.com as the ECH outer name. ACME excludes that name by default, custom names remain configurable, and the README explains how existing keys retain their original names.

The HTTP/3 concurrency regression test now establishes TCP sockets progressively while keeping all 400 open. This avoids overflowing macOS's 128-entry TCP accept queue while still exceeding the 256-stream QUIC limit.

Validation:

• cargo fmt --all -- --check
• cargo clippy --all-targets -- -D warnings
• cargo test --lib --tests
• shellcheck install.sh, sh -n install.sh, and git diff --check
• Live client/server installation on macOS, executable smoke checks, and checksum-rejection verification