Fix E2E test gaps and add comprehensive E2E + parity test suites

- Fix pull consumer fetch: send original stream subject in HMSG (not inbox)
  so NATS client distinguishes data messages from control messages
- Fix MaxAge expiry: add background timer in StreamManager for periodic pruning
- Fix JetStream wire format: Go-compatible anonymous objects with string enums,
  proper offset-based pagination for stream/consumer list APIs
- Add 42 E2E black-box tests (core messaging, auth, TLS, accounts, JetStream)
- Add ~1000 parity tests across all subsystems (gaps closure)
- Update gap inventory docs to reflect implementation status

tests/NATS.E2E.Tests/TlsTests.cs

@@ -0,0 +1,58 @@
+using NATS.Client.Core;
+using NATS.E2E.Tests.Infrastructure;
+
+namespace NATS.E2E.Tests;
+
+[Collection("E2E-TLS")]
+public class TlsTests(TlsServerFixture fixture)
+{
+    [Fact]
+    public async Task Tls_ClientConnectsSecurely()
+    {
+        await using var client = fixture.CreateTlsClient();
+        await client.ConnectAsync();
+
+        await client.PingAsync();
+
+        client.ConnectionState.ShouldBe(NatsConnectionState.Open);
+    }
+
+    [Fact]
+    public async Task Tls_PlainTextConnection_Rejected()
+    {
+        await using var client = fixture.CreatePlainClient();
+
+        var threw = false;
+        try
+        {
+            await client.ConnectAsync();
+            await client.PingAsync();
+        }
+        catch (Exception)
+        {
+            threw = true;
+        }
+
+        threw.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task Tls_PubSub_WorksOverEncryptedConnection()
+    {
+        await using var pub = fixture.CreateTlsClient();
+        await using var sub = fixture.CreateTlsClient();
+
+        await pub.ConnectAsync();
+        await sub.ConnectAsync();
+
+        await using var subscription = await sub.SubscribeCoreAsync<string>("tls.pubsub.test");
+        await sub.PingAsync();
+
+        await pub.PublishAsync("tls.pubsub.test", "secure-message");
+
+        using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+        var msg = await subscription.Msgs.ReadAsync(cts.Token);
+
+        msg.Data.ShouldBe("secure-message");
+    }
+}