feat: integrate authentication into server accept loop and client CONNECT processing

Wire AuthService into NatsServer and NatsClient to enforce authentication
on incoming connections. The server builds an AuthService from NatsOptions,
sets auth_required in ServerInfo, and generates per-client nonces when
NKey auth is configured. NatsClient validates credentials in ProcessConnect,
enforces publish/subscribe permissions, and implements an auth timeout that
closes connections that don't send CONNECT in time. Existing tests without
auth continue to work since AuthService.IsAuthRequired is false by default.

src/NATS.Server/NatsServer.cs

@@ -3,6 +3,7 @@ using System.Net;
 using System.Net.Sockets;
 using System.Text;
 using Microsoft.Extensions.Logging;
+using NATS.Server.Auth;
 using NATS.Server.Protocol;
 using NATS.Server.Subscriptions;
 
@@ -17,6 +18,9 @@ public sealed class NatsServer : IMessageRouter, ISubListAccess, IDisposable
     private readonly ILogger<NatsServer> _logger;
     private readonly ILoggerFactory _loggerFactory;
     private readonly TaskCompletionSource _listeningStarted = new(TaskCreationOptions.RunContinuationsAsynchronously);
+    private readonly AuthService _authService;
+    private readonly ConcurrentDictionary<string, Account> _accounts = new(StringComparer.Ordinal);
+    private readonly Account _globalAccount;
     private Socket? _listener;
     private ulong _nextClientId;
 
@@ -29,6 +33,9 @@ public sealed class NatsServer : IMessageRouter, ISubListAccess, IDisposable
         _options = options;
         _loggerFactory = loggerFactory;
         _logger = loggerFactory.CreateLogger<NatsServer>();
+        _authService = AuthService.Build(options);
+        _globalAccount = new Account(Account.GlobalAccountName);
+        _accounts[Account.GlobalAccountName] = _globalAccount;
         _serverInfo = new ServerInfo
         {
             ServerId = Guid.NewGuid().ToString("N")[..20].ToUpperInvariant(),
@@ -37,6 +44,7 @@ public sealed class NatsServer : IMessageRouter, ISubListAccess, IDisposable
             Host = options.Host,
             Port = options.Port,
             MaxPayload = options.MaxPayload,
+            AuthRequired = _authService.IsAuthRequired,
         };
     }
 
@@ -87,8 +95,27 @@ public sealed class NatsServer : IMessageRouter, ISubListAccess, IDisposable
 
                 _logger.LogDebug("Client {ClientId} connected from {RemoteEndpoint}", clientId, socket.RemoteEndPoint);
 
+                // Build per-client ServerInfo with nonce if NKey auth is configured
+                byte[]? nonce = null;
+                var clientInfo = _serverInfo;
+                if (_authService.NonceRequired)
+                {
+                    nonce = _authService.GenerateNonce();
+                    clientInfo = new ServerInfo
+                    {
+                        ServerId = _serverInfo.ServerId,
+                        ServerName = _serverInfo.ServerName,
+                        Version = _serverInfo.Version,
+                        Host = _serverInfo.Host,
+                        Port = _serverInfo.Port,
+                        MaxPayload = _serverInfo.MaxPayload,
+                        AuthRequired = _serverInfo.AuthRequired,
+                        Nonce = _authService.EncodeNonce(nonce),
+                    };
+                }
+
                 var clientLogger = _loggerFactory.CreateLogger($"NATS.Server.NatsClient[{clientId}]");
-                var client = new NatsClient(clientId, socket, _options, _serverInfo, clientLogger);
+                var client = new NatsClient(clientId, socket, _options, clientInfo, _authService, nonce, clientLogger);
                 client.Router = this;
                 _clients[clientId] = client;
 
@@ -169,11 +196,17 @@ public sealed class NatsServer : IMessageRouter, ISubListAccess, IDisposable
         _ = client.SendMessageAsync(subject, sub.Sid, replyTo, headers, payload, CancellationToken.None);
     }
 
+    public Account GetOrCreateAccount(string name)
+    {
+        return _accounts.GetOrAdd(name, n => new Account(n));
+    }
+
     public void RemoveClient(NatsClient client)
     {
         _clients.TryRemove(client.Id, out _);
         _logger.LogDebug("Removed client {ClientId}", client.Id);
         client.RemoveAllSubscriptions(_subList);
+        client.Account?.RemoveClient(client.Id);
     }
 
     public void Dispose()
@@ -182,5 +215,7 @@ public sealed class NatsServer : IMessageRouter, ISubListAccess, IDisposable
         foreach (var client in _clients.Values)
             client.Dispose();
         _subList.Dispose();
+        foreach (var account in _accounts.Values)
+            account.Dispose();
     }
 }