feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档

server_session.go

@@ -110,7 +110,17 @@ func (s *ServerCommon) registerAcceptedLogical(logical *LogicalConn) *LogicalCon
 	}
 	logical.setServer(s)
 	logical.applyAttachmentProfile(s.maxReadTimeout, s.maxWriteTimeout, s.defaultMsgEn, s.defaultMsgDe, s.defaultFastStreamEncode, s.defaultFastBulkEncode, s.defaultFastPlainEncode, s.handshakeRsaKey, s.SecretKey)
-	logical.setModernPSKRuntime(s.defaultModernPSKRuntime)
+	logical.updateAttachmentState(func(state *clientConnAttachmentState) {
+		state.authMode = s.securityAuthMode
+		state.peerAttached = false
+		state.peerAttachFallback = false
+		state.peerAttachAt = 0
+	})
+	if s.securityConfigured {
+		logical.applyTransportProtectionProfile(s.securityBootstrap)
+	} else {
+		logical.setModernPSKRuntime(s.defaultModernPSKRuntime)
+	}
 	logical.markHeartbeatNow()
 	return s.getPeerRegistry().registerLogical(logical)
 }