Improves flow handling and adds runtime stats APIs

Refactors TCP and UDP flow managers to enhance analyzer selection and flow binding accuracy, including O(1) UDP stream rebinding by 5-tuple.
Introduces runtime stats tracking for engine and ruleset operations, exposing new APIs for granular performance and error metrics.
Optimizes GeoMatcher with result caching and supports efficient geosite set matching, reducing redundant computation in ruleset expressions.

ruleset/builtins/geo/geo_matcher_test.go

@@ -1,13 +1,14 @@
 package geo
 
 import (
+	"sync/atomic"
 	"testing"
 
 	"git.difuse.io/Difuse/Mellaris/ruleset/builtins/geo/v2geo"
 )
 
 type fakeGeoLoader struct {
-	geoip  map[string]*v2geo.GeoIP
+	geoip   map[string]*v2geo.GeoIP
 	geosite map[string]*v2geo.GeoSite
 }
 
@@ -110,6 +111,83 @@ func TestGeoMatcher_MatchGeoSite_MissingSite(t *testing.T) {
 	}
 }
 
+func TestGeoMatcher_MatchGeoSiteSet(t *testing.T) {
+	loader := &fakeGeoLoader{
+		geosite: map[string]*v2geo.GeoSite{
+			"openai": {
+				Domain: []*v2geo.Domain{
+					{Type: v2geo.Domain_Plain, Value: "openai"},
+				},
+			},
+			"google": {
+				Domain: []*v2geo.Domain{
+					{Type: v2geo.Domain_RootDomain, Value: "google.com"},
+				},
+			},
+		},
+	}
+	g := NewGeoMatcher("", "")
+	g.geoLoader = loader
+
+	set := &SiteConditionSet{Conditions: []string{" google ", "openai", "OPENAI"}}
+	if !g.MatchGeoSiteSet("api.openai.com", set) {
+		t.Error("MatchGeoSiteSet should match openai")
+	}
+	if !g.MatchGeoSiteSet("mail.google.com", set) {
+		t.Error("MatchGeoSiteSet should match google")
+	}
+	if g.MatchGeoSiteSet("example.com", set) {
+		t.Error("MatchGeoSiteSet should not match unrelated host")
+	}
+}
+
+type countingMatcher struct {
+	calls *atomic.Uint64
+	match bool
+}
+
+func (m countingMatcher) Match(host HostInfo) bool {
+	_ = host
+	m.calls.Add(1)
+	return m.match
+}
+
+func TestGeoMatcher_MatchGeoSite_UsesResultCache(t *testing.T) {
+	g := NewGeoMatcher("", "")
+	var calls atomic.Uint64
+	g.geoSiteMatcher["openai"] = countingMatcher{calls: &calls, match: true}
+
+	if !g.MatchGeoSite("api.openai.com", "openai") {
+		t.Fatal("expected match")
+	}
+	if !g.MatchGeoSite("api.openai.com", "openai") {
+		t.Fatal("expected cached match")
+	}
+	if got := calls.Load(); got != 1 {
+		t.Fatalf("matcher calls=%d want=1", got)
+	}
+}
+
+func TestGeoMatcher_MatchGeoSiteSet_UsesResultCache(t *testing.T) {
+	g := NewGeoMatcher("", "")
+	var calls atomic.Uint64
+	g.geoSiteSets["openai\x1fyoutube"] = []hostMatcher{
+		countingMatcher{calls: &calls, match: false},
+		countingMatcher{calls: &calls, match: true},
+	}
+
+	set := &SiteConditionSet{Conditions: []string{"youtube", "openai"}}
+	if !g.MatchGeoSiteSet("www.youtube.com", set) {
+		t.Fatal("expected match")
+	}
+	if !g.MatchGeoSiteSet("www.youtube.com", set) {
+		t.Fatal("expected cached match")
+	}
+	if got := calls.Load(); got != 2 {
+		t.Fatalf("matcher calls=%d want=2", got)
+	}
+}
+
 func ipv4(a, b, c, d byte) []byte {
 	return []byte{a, b, c, d}
 }