feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档

server_config.go

@@ -31,22 +31,28 @@ func (s *ServerCommon) Stop() error {
 // Deprecated: SetDefaultCommEncode overrides the transport codec directly.
 // Prefer UseModernPSKServer or UseLegacySecurityServer.
 func (s *ServerCommon) SetDefaultCommEncode(fn func([]byte, []byte) []byte) {
-	s.defaultMsgEn = fn
-	s.defaultFastStreamEncode = nil
-	s.defaultFastBulkEncode = nil
-	s.defaultFastPlainEncode = nil
-	s.defaultModernPSKRuntime = nil
+	profile := transportProtectionProfile{
+		mode:      ProtectionManaged,
+		msgEn:     fn,
+		msgDe:     s.defaultMsgDe,
+		secretKey: s.SecretKey,
+	}
+	s.setServerDefaultTransportProtectionProfile(profile)
+	s.clearServerSecurityProfiles()
 	s.securityReadyCheck = false
 }
 
 // Deprecated: SetDefaultCommDecode overrides the transport codec directly.
 // Prefer UseModernPSKServer or UseLegacySecurityServer.
 func (s *ServerCommon) SetDefaultCommDecode(fn func([]byte, []byte) []byte) {
-	s.defaultMsgDe = fn
-	s.defaultFastStreamEncode = nil
-	s.defaultFastBulkEncode = nil
-	s.defaultFastPlainEncode = nil
-	s.defaultModernPSKRuntime = nil
+	profile := transportProtectionProfile{
+		mode:      ProtectionManaged,
+		msgEn:     s.defaultMsgEn,
+		msgDe:     fn,
+		secretKey: s.SecretKey,
+	}
+	s.setServerDefaultTransportProtectionProfile(profile)
+	s.clearServerSecurityProfiles()
 	s.securityReadyCheck = false
 }
 
@@ -98,14 +104,21 @@ func (s *ServerCommon) GetSecretKey() []byte {
 // Deprecated: SetSecretKey injects a raw transport key directly.
 // Prefer UseModernPSKServer or UseLegacySecurityServer.
 func (s *ServerCommon) SetSecretKey(key []byte) {
-	s.SecretKey = key
-	if len(key) == 0 {
-		s.defaultModernPSKRuntime = nil
-	} else if runtime, err := newModernPSKCodecRuntime(key, defaultModernPSKAAD); err == nil {
-		s.defaultModernPSKRuntime = runtime
-	} else {
-		s.defaultModernPSKRuntime = nil
+	profile := transportProtectionProfile{
+		mode:      ProtectionManaged,
+		msgEn:     s.defaultMsgEn,
+		msgDe:     s.defaultMsgDe,
+		secretKey: cloneTransportProtectionKey(key),
 	}
+	if len(key) == 0 {
+		profile.runtime = nil
+	} else if runtime, err := newModernPSKCodecRuntime(key, defaultModernPSKAAD); err == nil {
+		profile.runtime = runtime
+	} else {
+		profile.runtime = nil
+	}
+	s.setServerDefaultTransportProtectionProfile(profile)
+	s.clearServerSecurityProfiles()
 	s.securityReadyCheck = len(key) == 0
 }