feat: add monitoring HTTP endpoints and TLS support

Monitoring HTTP:
- /varz, /connz, /healthz via Kestrel Minimal API
- Pagination, sorting, subscription details on /connz
- ServerStats atomic counters, CPU/memory sampling
- CLI flags: -m, --http_port, --http_base_path, --https_port

TLS Support:
- 4-mode negotiation: no TLS, required, TLS-first, mixed
- Certificate loading, pinning (SHA-256), client cert verification
- PeekableStream for non-destructive TLS detection
- Token-bucket rate limiter for TLS handshakes
- CLI flags: --tls, --tlscert, --tlskey, --tlscacert, --tlsverify

29 new tests (78 → 107 total), all passing.

# Conflicts:
#	src/NATS.Server.Host/Program.cs
#	src/NATS.Server/NATS.Server.csproj
#	src/NATS.Server/NatsClient.cs
#	src/NATS.Server/NatsOptions.cs
#	src/NATS.Server/NatsServer.cs
#	src/NATS.Server/Protocol/NatsProtocol.cs
#	tests/NATS.Server.Tests/ClientTests.cs

src/NATS.Server/NatsClient.cs

@@ -1,5 +1,6 @@
 using System.Buffers;
 using System.IO.Pipelines;
+using System.Net;
 using System.Net.Sockets;
 using System.Security.Cryptography;
 using System.Text;
@@ -8,6 +9,7 @@ using Microsoft.Extensions.Logging;
 using NATS.Server.Auth;
 using NATS.Server.Protocol;
 using NATS.Server.Subscriptions;
+using NATS.Server.Tls;
 
 namespace NATS.Server;
 
@@ -26,7 +28,7 @@ public interface ISubListAccess
 public sealed class NatsClient : IDisposable
 {
     private readonly Socket _socket;
-    private readonly NetworkStream _stream;
+    private readonly Stream _stream;
     private readonly NatsOptions _options;
     private readonly ServerInfo _serverInfo;
     private readonly AuthService _authService;
@@ -37,6 +39,7 @@ public sealed class NatsClient : IDisposable
     private readonly Dictionary<string, Subscription> _subs = new();
     private readonly ILogger _logger;
     private ClientPermissions? _permissions;
+    private readonly ServerStats _serverStats;
 
     public ulong Id { get; }
     public ClientOptions? ClientOpts { get; private set; }
@@ -47,6 +50,12 @@ public sealed class NatsClient : IDisposable
     private int _connectReceived;
     public bool ConnectReceived => Volatile.Read(ref _connectReceived) != 0;
 
+    public DateTime StartTime { get; }
+    private long _lastActivityTicks;
+    public DateTime LastActivity => new(Interlocked.Read(ref _lastActivityTicks), DateTimeKind.Utc);
+    public string? RemoteIp { get; }
+    public int RemotePort { get; }
+
     // Stats
     public long InMsgs;
     public long OutMsgs;
@@ -57,20 +66,31 @@ public sealed class NatsClient : IDisposable
     private int _pingsOut;
     private long _lastIn;
 
+    public TlsConnectionState? TlsState { get; set; }
+    public bool InfoAlreadySent { get; set; }
+
     public IReadOnlyDictionary<string, Subscription> Subscriptions => _subs;
 
-    public NatsClient(ulong id, Socket socket, NatsOptions options, ServerInfo serverInfo,
-        AuthService authService, byte[]? nonce, ILogger logger)
+    public NatsClient(ulong id, Stream stream, Socket socket, NatsOptions options, ServerInfo serverInfo,
+        AuthService authService, byte[]? nonce, ILogger logger, ServerStats serverStats)
     {
         Id = id;
         _socket = socket;
-        _stream = new NetworkStream(socket, ownsSocket: false);
+        _stream = stream;
         _options = options;
         _serverInfo = serverInfo;
         _authService = authService;
         _nonce = nonce;
         _logger = logger;
+        _serverStats = serverStats;
         _parser = new NatsParser(options.MaxPayload);
+        StartTime = DateTime.UtcNow;
+        _lastActivityTicks = StartTime.Ticks;
+        if (socket.RemoteEndPoint is IPEndPoint ep)
+        {
+            RemoteIp = ep.Address.ToString();
+            RemotePort = ep.Port;
+        }
     }
 
     public async Task RunAsync(CancellationToken ct)
@@ -80,8 +100,9 @@ public sealed class NatsClient : IDisposable
         var pipe = new Pipe();
         try
         {
-            // Send INFO
-            await SendInfoAsync(_clientCts.Token);
+            // Send INFO (skip if already sent during TLS negotiation)
+            if (!InfoAlreadySent)
+                await SendInfoAsync(_clientCts.Token);
 
             // Start auth timeout if auth is required
             Task? authTimeoutTask = null;
@@ -100,7 +121,7 @@ public sealed class NatsClient : IDisposable
                     }
                     catch (OperationCanceledException)
                     {
-                        // Normal — client connected or was cancelled
+                        // Normal -- client connected or was cancelled
                     }
                 }, _clientCts.Token);
             }
@@ -184,6 +205,8 @@ public sealed class NatsClient : IDisposable
 
     private async ValueTask DispatchCommandAsync(ParsedCommand cmd, CancellationToken ct)
     {
+        Interlocked.Exchange(ref _lastActivityTicks, DateTime.UtcNow.Ticks);
+
         // If auth is required and CONNECT hasn't been received yet,
         // only allow CONNECT and PING commands
         if (_authService.IsAuthRequired && !ConnectReceived)
@@ -266,7 +289,7 @@ public sealed class NatsClient : IDisposable
 
             _logger.LogDebug("Client {ClientId} authenticated as {Identity}", Id, result.Identity);
 
-            // Clear nonce after use — defense-in-depth against memory dumps
+            // Clear nonce after use -- defense-in-depth against memory dumps
             if (_nonce != null)
                 CryptographicOperations.ZeroMemory(_nonce);
         }
@@ -330,6 +353,8 @@ public sealed class NatsClient : IDisposable
     {
         Interlocked.Increment(ref InMsgs);
         Interlocked.Add(ref InBytes, cmd.Payload.Length);
+        Interlocked.Increment(ref _serverStats.InMsgs);
+        Interlocked.Add(ref _serverStats.InBytes, cmd.Payload.Length);
 
         // Max payload validation (always, hard close)
         if (cmd.Payload.Length > _options.MaxPayload)
@@ -380,6 +405,8 @@ public sealed class NatsClient : IDisposable
     {
         Interlocked.Increment(ref OutMsgs);
         Interlocked.Add(ref OutBytes, payload.Length + headers.Length);
+        Interlocked.Increment(ref _serverStats.OutMsgs);
+        Interlocked.Add(ref _serverStats.OutBytes, payload.Length + headers.Length);
 
         byte[] line;
         if (headers.Length > 0)
@@ -470,7 +497,7 @@ public sealed class NatsClient : IDisposable
 
                 if (Volatile.Read(ref _pingsOut) + 1 > _options.MaxPingsOut)
                 {
-                    _logger.LogDebug("Client {ClientId} stale connection — closing", Id);
+                    _logger.LogDebug("Client {ClientId} stale connection -- closing", Id);
                     await SendErrAndCloseAsync(NatsProtocol.ErrStaleConnection);
                     return;
                 }