fix(libmsg): security audit round 4 - eliminate residual race + atomic server_fd

- P1-3: introduce ConnectionLock (mutex + atomic active) to close the residual
  CWE-362 race where _remove_client closes fd before reply/broadcast acquires
  the lock; senders now check active after locking and abort if fd was closed
- P2-7: make _server_fd std::atomic<int> to remove the data-race UB between
  stop() and _event_loop
- P2-8: validate on_message is non-null in MsgServer::start()
- P3-2: distinguish missing _route vs wrong-typed _route in RpcServer
- P3-3: set TCP_NODELAY/SO_SNDTIMEO before registering fd in _clients
- doc: add SO_SNDTIMEO precondition note to pmsg_send

libmsg/inc/us/RpcServer.hpp

@@ -132,9 +132,12 @@ private:
         if (auto it = req.find("_route"); it != req.end() && it->value().is_string()) {
             route = it->value().as_string().c_str();
             req.erase(it);  // 从业务参数中移除 _route
-        } else {
+        } else if (it == req.end()) {
             _reply_error(fd, "missing _route");
             return;
+        } else {
+            _reply_error(fd, "_route must be a string");
+            return;
         }
 
         // 查找 handler