feat: enhance ConfigProcessor & add 110 Go-parity opts tests (Task 22)

Port configuration parsing for NKey users, gateway remotes, leaf node
remotes, auth timeout, write_deadline, websocket ping_interval, and
token+users conflict validation. Add RemoteGatewayOptions, enhanced
LeafNodeOptions with remotes support.

110 new tests ported from opts_test.go.

src/NATS.Server/Configuration/LeafNodeOptions.cs

@@ -1,49 +1,63 @@
 namespace NATS.Server.Configuration;
 
+/// <summary>
+/// Remote leaf node entry parsed from the remotes[] array inside a leafnodes {} block.
+/// Go reference: opts.go RemoteLeafOpts struct.
+/// </summary>
+public sealed class RemoteLeafOptions
+{
+    /// <summary>Local account to bind this remote to.</summary>
+    public string? LocalAccount { get; init; }
+
+    /// <summary>Path to credentials file.</summary>
+    public string? Credentials { get; init; }
+
+    /// <summary>URLs for this remote entry.</summary>
+    public List<string> Urls { get; init; } = [];
+
+    /// <summary>Whether to not randomize URL order.</summary>
+    public bool DontRandomize { get; init; }
+}
+
 public sealed class LeafNodeOptions
 {
     public string Host { get; set; } = "0.0.0.0";
     public int Port { get; set; }
+
+    // Auth for leaf listener
+    public string? Username { get; set; }
+    public string? Password { get; set; }
+    public double AuthTimeout { get; set; }
+
+    // Advertise address
+    public string? Advertise { get; set; }
+
+    // Per-subsystem write deadline
+    public TimeSpan WriteDeadline { get; set; }
+
+    /// <summary>
+    /// Simple URL list for programmatic setup (tests, server-code wiring).
+    /// Parsed config populates RemoteLeaves instead.
+    /// </summary>
     public List<string> Remotes { get; set; } = [];
 
     /// <summary>
-    /// JetStream domain for this leaf node. When set, the domain is propagated
-    /// during the leaf handshake for domain-aware JetStream routing.
-    /// Go reference: leafnode.go — JsDomain in leafNodeCfg.
+    /// Remote leaf node entries parsed from a config file (remotes: [] array).
+    /// Each entry has a local account, credentials, and a list of URLs.
+    /// </summary>
+    public List<RemoteLeafOptions> RemoteLeaves { get; set; } = [];
+
+    /// <summary>
+    /// JetStream domain for this leaf node.
+    /// Go reference: leafnode.go -- JsDomain in leafNodeCfg.
     /// </summary>
     public string? JetStreamDomain { get; set; }
 
-    /// <summary>
-    /// Subjects to deny exporting (hub→leaf direction). Messages matching any of
-    /// these patterns will not be forwarded from the hub to the leaf.
-    /// Supports wildcards (* and >).
-    /// Go reference: leafnode.go — DenyExports in RemoteLeafOpts (opts.go:231).
-    /// </summary>
     public List<string> DenyExports { get; set; } = [];
-
-    /// <summary>
-    /// Subjects to deny importing (leaf→hub direction). Messages matching any of
-    /// these patterns will not be forwarded from the leaf to the hub.
-    /// Supports wildcards (* and >).
-    /// Go reference: leafnode.go — DenyImports in RemoteLeafOpts (opts.go:230).
-    /// </summary>
     public List<string> DenyImports { get; set; } = [];
-
-    /// <summary>
-    /// Explicit allow-list for exported subjects (hub→leaf direction). When non-empty,
-    /// only messages matching at least one of these patterns will be forwarded from
-    /// the hub to the leaf. Deny patterns (<see cref="DenyExports"/>) take precedence.
-    /// Supports wildcards (* and >).
-    /// Go reference: auth.go — SubjectPermission.Allow (Publish allow list).
-    /// </summary>
     public List<string> ExportSubjects { get; set; } = [];
-
-    /// <summary>
-    /// Explicit allow-list for imported subjects (leaf→hub direction). When non-empty,
-    /// only messages matching at least one of these patterns will be forwarded from
-    /// the leaf to the hub. Deny patterns (<see cref="DenyImports"/>) take precedence.
-    /// Supports wildcards (* and >).
-    /// Go reference: auth.go — SubjectPermission.Allow (Subscribe allow list).
-    /// </summary>
     public List<string> ImportSubjects { get; set; } = [];
+
+    /// <summary>List of users for leaf listener authentication (from authorization.users).</summary>
+    public List<NATS.Server.Auth.User>? Users { get; set; }
 }