feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档

peer_identity.go

@@ -15,14 +15,23 @@ const (
 )
 
 type peerAttachRequest struct {
-	PeerID string
+	PeerID               string
+	Features             uint64
+	ClientNonce          []byte
+	ClientECDHEPublicKey []byte
+	AuthTag              []byte
 }
 
 type peerAttachResponse struct {
-	PeerID   string
-	Accepted bool
-	Reused   bool
-	Error    string
+	PeerID               string
+	Accepted             bool
+	Reused               bool
+	Error                string
+	Features             uint64
+	KeyMode              string
+	ServerNonce          []byte
+	ServerECDHEPublicKey []byte
+	AuthTag              []byte
 }
 
 func newClientPeerIdentity() string {
@@ -108,7 +117,11 @@ func (c *ClientCommon) announceClientPeerIdentity() error {
 	if peerID == "" {
 		return errors.New("peer identity is empty")
 	}
-	encoded, err := c.sequenceEn(peerAttachRequest{PeerID: peerID})
+	req, requestState, err := c.buildPeerAttachRequest(peerID)
+	if err != nil {
+		return err
+	}
+	encoded, err := c.sequenceEn(req)
 	if err != nil {
 		return err
 	}
@@ -133,6 +146,12 @@ func (c *ClientCommon) announceClientPeerIdentity() error {
 		}
 		return errors.New("peer attach rejected")
 	}
+	verifyResult, err := c.verifyPeerAttachResponse(req, resp, requestState)
+	if err != nil {
+		return err
+	}
+	c.setClientNegotiatedSteadyTransportProtection(verifyResult.steadyProfile)
+	c.markClientPeerAttachAuthenticated(verifyResult.authFallback, time.Now())
 	return nil
 }
 
@@ -188,7 +207,7 @@ func (s *ServerCommon) replyPeerAttach(client *LogicalConn, message Message, res
 		Type:  MSG_SYS_REPLY,
 	}
 	if message.inboundConn != nil {
-		return s.sendTransferInbound(client, messageTransportConnSnapshot(&message), message.inboundConn, reply)
+		return s.sendTransferInbound(client, messageTransportConnSnapshot(&message), message.inboundConn, messageInboundTransportProtectionSnapshot(&message), reply)
 	}
 	_, err = s.sendLogical(client, reply)
 	return err
@@ -200,6 +219,10 @@ func (s *ServerCommon) handlePeerAttachSystemMessage(message Message) bool {
 	}
 	message = hydrateServerMessagePeerFields(message)
 	current := messageLogicalConnSnapshot(&message)
+	transport := message.inboundConn
+	if transport == nil && current != nil {
+		transport = current.transportSnapshot()
+	}
 	req, err := decodePeerAttachRequest(s.sequenceDe, message.Value)
 	if err != nil {
 		if current != nil {
@@ -210,6 +233,18 @@ func (s *ServerCommon) handlePeerAttachSystemMessage(message Message) bool {
 		}
 		return true
 	}
+	auth, err := s.validatePeerAttachRequestAuth(current, transport, req)
+	if err != nil {
+		classifyPeerAttachRejectCounter(s, err)
+		if current != nil {
+			_ = s.replyPeerAttach(current, message, peerAttachResponse{
+				PeerID:   req.PeerID,
+				Accepted: false,
+				Error:    err.Error(),
+			})
+		}
+		return true
+	}
 	bound, reused, err := s.bindAcceptedClientIdentity(current, req.PeerID)
 	if err != nil {
 		if current != nil {
@@ -221,12 +256,37 @@ func (s *ServerCommon) handlePeerAttachSystemMessage(message Message) bool {
 		}
 		return true
 	}
-	if err := s.replyPeerAttach(bound, message, peerAttachResponse{
+	resp := peerAttachResponse{
 		PeerID:   bound.ID(),
 		Accepted: true,
 		Reused:   reused,
-	}); err != nil && bound != nil {
+	}
+	steadyProfile, err := s.preparePeerAttachSteadyTransportProfile(bound, req, &resp, auth)
+	if err != nil {
+		if bound != nil {
+			_ = s.replyPeerAttach(bound, message, peerAttachResponse{
+				PeerID:   req.PeerID,
+				Accepted: false,
+				Error:    err.Error(),
+			})
+		}
+		return true
+	}
+	s.signPeerAttachResponse(bound, req, &resp, auth)
+	if bound != nil {
+		bound.markPeerAttachAuthenticated(s.securityAuthMode, auth.fallback, time.Now())
+		if auth.explicit {
+			s.peerAttachExplicitCount.Add(1)
+		} else if auth.fallback {
+			s.peerAttachAuthFallbackCount.Add(1)
+		}
+	}
+	if err := s.replyPeerAttach(bound, message, resp); err != nil && bound != nil {
 		s.stopLogicalSession(bound, "peer attach reply failed", err)
+		return true
+	}
+	if bound != nil && s.securityConfigured {
+		bound.applyTransportProtectionProfile(steadyProfile)
 	}
 	return true
 }