feat: add leaf node permission and account syncing (Gap 12.2)

Add SetPermissions/PermsSynced/AllowedPublishSubjects/AllowedSubscribeSubjects/AccountName
to LeafConnection, and SendPermsAndAccountInfo/InitLeafNodeSmapAndSendSubs/GetPermSyncStatus
plus LeafPermSyncResult to LeafNodeManager. Add OnConnectionRegistered internal callback for
test synchronization. 10 new unit tests in LeafPermissionSyncTests.cs all passing.

src/NATS.Server/LeafNodes/LeafNodeManager.cs

@@ -29,6 +29,12 @@ public sealed class LeafNodeManager : IAsyncDisposable
     private Socket? _listener;
     private Task? _acceptLoopTask;
 
+    /// <summary>
+    /// Invoked each time a connection is successfully registered.
+    /// Exposed for test synchronization only.
+    /// </summary>
+    internal Action<string>? OnConnectionRegistered;
+
     /// <summary>
     /// Initial retry delay for solicited connections (1 second).
     /// Go reference: leafnode.go — DEFAULT_LEAF_NODE_RECONNECT constant.
@@ -416,6 +422,8 @@ public sealed class LeafNodeManager : IAsyncDisposable
             return;
         }
 
+        OnConnectionRegistered?.Invoke(key);
+
         connection.RemoteSubscriptionReceived = sub =>
         {
             _remoteSubSink(sub);