feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档

server.go

@@ -10,52 +10,65 @@ import (
 )
 
 type ServerCommon struct {
-	msgID                      uint64
-	alive                      atomic.Value
-	status                     Status
-	sessionOwnerState          atomic.Int32
-	sessionRuntime             atomic.Pointer[serverSessionRuntime]
-	listener                   net.Listener
-	udpListener                *net.UDPConn
-	queue                      *stario.StarQueue
-	stopFn                     context.CancelFunc
-	stopCtx                    context.Context
-	maxReadTimeout             time.Duration
-	maxWriteTimeout            time.Duration
-	parallelNum                int
-	wg                         stario.WaitGroup
-	peerRegistry               *serverPeerRegistry
-	mu                         sync.RWMutex
-	handshakeRsaKey            []byte
-	SecretKey                  []byte
-	defaultMsgEn               func([]byte, []byte) []byte
-	defaultMsgDe               func([]byte, []byte) []byte
-	defaultFastStreamEncode    transportFastStreamEncoder
-	defaultFastBulkEncode      transportFastBulkEncoder
-	defaultFastPlainEncode     transportFastPlainEncoder
-	defaultModernPSKRuntime    *modernPSKCodecRuntime
-	linkFns                    map[string]func(message *Message)
-	defaultFns                 func(message *Message)
-	noFinSyncMsgMaxKeepSeconds int64
-	maxHeartbeatLostSeconds    int64
-	sequenceDe                 func([]byte) (interface{}, error)
-	sequenceEn                 func(interface{}) ([]byte, error)
-	logicalSession             *logicalSessionState
-	onFileEvent                func(FileEvent)
-	fileEventObserver          func(FileEvent)
-	fileTransferCfg            fileTransferConfig
-	signalReliableCfg          signalReliabilityConfig
-	streamRuntime              *streamRuntime
-	recordRuntime              *recordRuntime
-	bulkRuntime                *bulkRuntime
-	bulkOpenTuning             BulkOpenTuning
-	bulkDedicatedSidecarMu     sync.Mutex
-	bulkDedicatedSidecars      map[*LogicalConn]map[uint32]*bulkDedicatedSidecar
-	connectionRetryState       *connectionRetryState
-	detachedClientKeepSeconds  int64
-	securityReadyCheck         bool
-	showError                  bool
-	debugMode                  bool
+	msgID                          uint64
+	alive                          atomic.Value
+	status                         Status
+	sessionOwnerState              atomic.Int32
+	sessionRuntime                 atomic.Pointer[serverSessionRuntime]
+	listener                       net.Listener
+	udpListener                    *net.UDPConn
+	queue                          *stario.StarQueue
+	stopFn                         context.CancelFunc
+	stopCtx                        context.Context
+	maxReadTimeout                 time.Duration
+	maxWriteTimeout                time.Duration
+	parallelNum                    int
+	wg                             stario.WaitGroup
+	peerRegistry                   *serverPeerRegistry
+	mu                             sync.RWMutex
+	handshakeRsaKey                []byte
+	SecretKey                      []byte
+	defaultMsgEn                   func([]byte, []byte) []byte
+	defaultMsgDe                   func([]byte, []byte) []byte
+	defaultFastStreamEncode        transportFastStreamEncoder
+	defaultFastBulkEncode          transportFastBulkEncoder
+	defaultFastPlainEncode         transportFastPlainEncoder
+	defaultModernPSKRuntime        *modernPSKCodecRuntime
+	peerAttachSecurity             atomic.Pointer[peerAttachSecurityState]
+	securityBootstrap              transportProtectionProfile
+	securitySteady                 transportProtectionProfile
+	securityAuthMode               AuthMode
+	securityProtectionMode         ProtectionMode
+	securityRequireForwardSecrecy  bool
+	securityConfigured             bool
+	peerAttachReplay               peerAttachReplayCache
+	peerAttachExplicitCount        atomic.Int64
+	peerAttachAuthFallbackCount    atomic.Int64
+	peerAttachAuthRejectCount      atomic.Int64
+	peerAttachDowngradeRejectCount atomic.Int64
+	peerAttachBindingRejectCount   atomic.Int64
+	linkFns                        map[string]func(message *Message)
+	defaultFns                     func(message *Message)
+	noFinSyncMsgMaxKeepSeconds     int64
+	maxHeartbeatLostSeconds        int64
+	sequenceDe                     func([]byte) (interface{}, error)
+	sequenceEn                     func(interface{}) ([]byte, error)
+	logicalSession                 *logicalSessionState
+	onFileEvent                    func(FileEvent)
+	fileEventObserver              func(FileEvent)
+	fileTransferCfg                fileTransferConfig
+	signalReliableCfg              signalReliabilityConfig
+	streamRuntime                  *streamRuntime
+	recordRuntime                  *recordRuntime
+	bulkRuntime                    *bulkRuntime
+	bulkOpenTuning                 BulkOpenTuning
+	bulkDedicatedSidecarMu         sync.Mutex
+	bulkDedicatedSidecars          map[*LogicalConn]map[uint32]*bulkDedicatedSidecar
+	connectionRetryState           *connectionRetryState
+	detachedClientKeepSeconds      int64
+	securityReadyCheck             bool
+	showError                      bool
+	debugMode                      bool
 }
 
 func NewServer() Server {
@@ -93,6 +106,8 @@ func NewServer() Server {
 	server.defaultFns = func(message *Message) {
 		return
 	}
+	server.setServerDefaultTransportProtectionProfile(defaultTransportProtectionProfile())
+	server.peerAttachSecurity.Store(defaultPeerAttachSecurityState())
 	server.sessionRuntime.Store(newServerSessionRuntimeBase(server.stopCtx, server.stopFn))
 	bindServerStreamControl(&server)
 	bindServerBulkControl(&server)