E6: Add IsSystemAccount property to Account, mark $SYS account as system,
add IsSystemSubject/IsSubscriptionAllowed/GetSubListForSubject helpers to
route $SYS.> subjects to the system account's SubList and block non-system
accounts from subscribing.
E7: Add ConfigReloader.ReloadAsync and ApplyDiff for structured async reload,
add ConfigReloadResult/ConfigApplyResult types. SIGHUP handler already wired
via PosixSignalRegistration in HandleSignals.
E8: Add PropagateAuthChanges to re-evaluate connected clients after auth
config reload, disconnecting clients whose credentials no longer pass
authentication with -ERR 'Authorization Violation'.
Adds OptsGoParityTests.cs with 49 tests porting 15 unmapped Go test
functions from server/opts_test.go: random port semantics, listen port
config variants, multiple users, authorization block parsing, options
defaults (TestDefaultSentinel), write_deadline parsing, path handling,
variable/env-var substitution chains, and unknown field tolerance.
