fix(libmsg): security audit round 4 - eliminate residual race + atomic server_fd

- P1-3: introduce ConnectionLock (mutex + atomic active) to close the residual
  CWE-362 race where _remove_client closes fd before reply/broadcast acquires
  the lock; senders now check active after locking and abort if fd was closed
- P2-7: make _server_fd std::atomic<int> to remove the data-race UB between
  stop() and _event_loop
- P2-8: validate on_message is non-null in MsgServer::start()
- P3-2: distinguish missing _route vs wrong-typed _route in RpcServer
- P3-3: set TCP_NODELAY/SO_SNDTIMEO before registering fd in _clients
- doc: add SO_SNDTIMEO precondition note to pmsg_send

libmsg/inc/us/Msg.hpp

@@ -286,6 +286,9 @@ inline int openConnection(const std::string& addr, int port, double timeout) {
 // ============================================================================
 
 /// 以 pymsg 协议发送一条字符串消息（长度前缀 + UTF-8 载荷）。
+/// 注意：sendAll() 依赖 socket 已设置的 SO_SNDTIMEO，否则慢客户端不读数据时
+/// send() 会永久阻塞。MsgClient 和 MsgServer 内部均已设置 SO_SNDTIMEO，
+/// 直接使用此公共 API 时需自行设置。
 inline void pmsg_send(int sockfd, const std::string &data) {
     size_t payload_size = data.size();
     if (payload_size > msg_constants::kMaxMsgSize) {