Fix E2E test gaps and add comprehensive E2E + parity test suites

- Fix pull consumer fetch: send original stream subject in HMSG (not inbox)
  so NATS client distinguishes data messages from control messages
- Fix MaxAge expiry: add background timer in StreamManager for periodic pruning
- Fix JetStream wire format: Go-compatible anonymous objects with string enums,
  proper offset-based pagination for stream/consumer list APIs
- Add 42 E2E black-box tests (core messaging, auth, TLS, accounts, JetStream)
- Add ~1000 parity tests across all subsystems (gaps closure)
- Update gap inventory docs to reflect implementation status

tests/NATS.Server.Tests/Auth/AuthServiceParityBatch4Tests.cs

@@ -0,0 +1,89 @@
+using NATS.NKeys;
+using NATS.Server.Auth;
+using NATS.Server.Protocol;
+
+namespace NATS.Server.Tests.Auth;
+
+public class AuthServiceParityBatch4Tests
+{
+    [Fact]
+    public void Build_assigns_global_account_to_orphan_users()
+    {
+        var service = AuthService.Build(new NatsOptions
+        {
+            Users = [new User { Username = "alice", Password = "secret" }],
+        });
+
+        var result = service.Authenticate(new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = "alice", Password = "secret" },
+            Nonce = [],
+        });
+
+        result.ShouldNotBeNull();
+        result.AccountName.ShouldBe(Account.GlobalAccountName);
+    }
+
+    [Fact]
+    public void Build_assigns_global_account_to_orphan_nkeys()
+    {
+        using var kp = KeyPair.CreatePair(PrefixByte.User);
+        var pub = kp.GetPublicKey();
+        var nonce = "test-nonce"u8.ToArray();
+        var sig = new byte[64];
+        kp.Sign(nonce, sig);
+
+        var service = AuthService.Build(new NatsOptions
+        {
+            NKeys = [new NKeyUser { Nkey = pub }],
+        });
+
+        var result = service.Authenticate(new ClientAuthContext
+        {
+            Opts = new ClientOptions
+            {
+                Nkey = pub,
+                Sig = Convert.ToBase64String(sig),
+            },
+            Nonce = nonce,
+        });
+
+        result.ShouldNotBeNull();
+        result.AccountName.ShouldBe(Account.GlobalAccountName);
+    }
+
+    [Fact]
+    public void Build_validates_response_permissions_defaults_and_publish_allow()
+    {
+        var service = AuthService.Build(new NatsOptions
+        {
+            Users =
+            [
+                new User
+                {
+                    Username = "alice",
+                    Password = "secret",
+                    Permissions = new Permissions
+                    {
+                        Response = new ResponsePermission { MaxMsgs = 0, Expires = TimeSpan.Zero },
+                    },
+                },
+            ],
+        });
+
+        var result = service.Authenticate(new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = "alice", Password = "secret" },
+            Nonce = [],
+        });
+
+        result.ShouldNotBeNull();
+        result.Permissions.ShouldNotBeNull();
+        result.Permissions.Response.ShouldNotBeNull();
+        result.Permissions.Response.MaxMsgs.ShouldBe(NatsProtocol.DefaultAllowResponseMaxMsgs);
+        result.Permissions.Response.Expires.ShouldBe(NatsProtocol.DefaultAllowResponseExpiration);
+        result.Permissions.Publish.ShouldNotBeNull();
+        result.Permissions.Publish.Allow.ShouldNotBeNull();
+        result.Permissions.Publish.Allow.Count.ShouldBe(0);
+    }
+}