StartTunnel gains shell completion and isolates login throttling by server address and public or private access.

## Highlights

- Complete `start-tunnel` commands and options with Tab in new Bash shells.
- Generate completion scripts for other shells with `start-tunnel completions <shell>`.
- Login attempts against one server address no longer block signing in through another. Public and private access have separate limits.
- The first blocked login in each throttle window logs the client IP and server address.
- NAT-PMP clients get an immediate "unsupported version" reply instead of no answer, so they fall back to PCP or UPnP right away rather than retrying for about two minutes.