feat: port session 07 — Protocol Parser, Auth extras (TPM/certidp/certstore), Internal utilities & data structures

Session 07 scope (5 features, 17 tests, ~1165 Go LOC):
- Protocol/ParserTypes.cs: ParserState enum (79 states), PublishArgument, ParseContext
- Protocol/IProtocolHandler.cs: handler interface decoupling parser from client
- Protocol/ProtocolParser.cs: Parse(), ProtoSnippet(), OverMaxControlLineLimit(),
  ProcessPub/HeaderPub/RoutedMsgArgs/RoutedHeaderMsgArgs, ClonePubArg(), GetHeader()
- tests/Protocol/ProtocolParserTests.cs: 17 tests via TestProtocolHandler stub

Auth extras from session 06 (committed separately):
- Auth/TpmKeyProvider.cs, Auth/CertificateIdentityProvider/, Auth/CertificateStore/

Internal utilities & data structures (session 06 overflow):
- Internal/AccessTimeService.cs, ElasticPointer.cs, SystemMemory.cs, ProcessStatsProvider.cs
- Internal/DataStructures/GenericSublist.cs, HashWheel.cs
- Internal/DataStructures/SubjectTree.cs, SubjectTreeNode.cs, SubjectTreeParts.cs

All 461 tests pass (460 unit + 1 integration). DB updated for features 2588-2592 and tests 2598-2614.

docs/plans/phases/phase6sessions/session-06.md

@@ -0,0 +1,45 @@
+# Session 06: Authentication & JWT
+
+## Summary
+
+Authentication handlers (user/pass, token, NKey, TLS cert), auth callout (external auth service), JWT processing, and cipher suite definitions.
+
+## Scope
+
+| Go File | Features | Feature IDs | Go LOC |
+|---------|----------|-------------|--------|
+| server/auth.go | 31 | 350–380 | 1,498 |
+| server/auth_callout.go | 3 | 381–383 | 456 |
+| server/jwt.go | 6 | 1973–1978 | 205 |
+| server/ciphersuites.go | 3 | 384–386 | 37 |
+| **Total** | **43** | | **2,196** |
+
+## .NET Classes
+
+- `AuthHandler` — authentication dispatch and credential checking
+- `AuthCallout` — external auth callout service
+- `JwtProcessor` — NATS JWT validation and claims extraction
+- `CipherSuites` — TLS cipher suite definitions
+
+## Test Files
+
+| Test File | Tests | Test IDs |
+|-----------|-------|----------|
+| server/auth_test.go | 12 | 142–153 |
+| server/auth_callout_test.go | 31 | 111–141 |
+| server/jwt_test.go | 88 | 1809–1896 |
+| **Total** | **131** | |
+
+## Dependencies
+
+- Session 01 (Foundation Types — errors, constants)
+- Session 03 (Configuration — ServerOptions for auth config)
+
+## .NET Target Location
+
+- `dotnet/src/ZB.MOM.NatsNet.Server/Auth/`
+
+## Notes
+
+- Auth is already partially scaffolded from leaf modules (certidp, certstore, tpm)
+- JWT test file is large (88 tests) — may need careful batching within the session