Covers /varz, /connz endpoints via Kestrel Minimal APIs,
full TLS support with four modes (none/required/first/mixed),
cert pinning, rate limiting, and testing strategy.
Four tasks: -ERR infrastructure, MaxConnections enforcement,
pedantic subject validation + max payload on PUB, PING keepalive.
Full TDD steps with exact code and commands.
10 tasks from scaffolding through integration tests, each with
TDD steps, exact file paths, and complete code. Bottom-up order:
SubList → Parser → Client → Server → Integration.
