feat: add monitoring HTTP endpoints and TLS support
Monitoring HTTP:
- /varz, /connz, /healthz via Kestrel Minimal API
- Pagination, sorting, subscription details on /connz
- ServerStats atomic counters, CPU/memory sampling
- CLI flags: -m, --http_port, --http_base_path, --https_port
TLS Support:
- 4-mode negotiation: no TLS, required, TLS-first, mixed
- Certificate loading, pinning (SHA-256), client cert verification
- PeekableStream for non-destructive TLS detection
- Token-bucket rate limiter for TLS handshakes
- CLI flags: --tls, --tlscert, --tlskey, --tlscacert, --tlsverify
29 new tests (78 → 107 total), all passing.
# Conflicts:
# src/NATS.Server.Host/Program.cs
# src/NATS.Server/NATS.Server.csproj
# src/NATS.Server/NatsClient.cs
# src/NATS.Server/NatsOptions.cs
# src/NATS.Server/NatsServer.cs
# src/NATS.Server/Protocol/NatsProtocol.cs
# tests/NATS.Server.Tests/ClientTests.cs
4d89661e79