feat: port session 07 — Protocol Parser, Auth extras (TPM/certidp/certstore), Internal utilities & data structures

Session 07 scope (5 features, 17 tests, ~1165 Go LOC):
- Protocol/ParserTypes.cs: ParserState enum (79 states), PublishArgument, ParseContext
- Protocol/IProtocolHandler.cs: handler interface decoupling parser from client
- Protocol/ProtocolParser.cs: Parse(), ProtoSnippet(), OverMaxControlLineLimit(),
  ProcessPub/HeaderPub/RoutedMsgArgs/RoutedHeaderMsgArgs, ClonePubArg(), GetHeader()
- tests/Protocol/ProtocolParserTests.cs: 17 tests via TestProtocolHandler stub

Auth extras from session 06 (committed separately):
- Auth/TpmKeyProvider.cs, Auth/CertificateIdentityProvider/, Auth/CertificateStore/

Internal utilities & data structures (session 06 overflow):
- Internal/AccessTimeService.cs, ElasticPointer.cs, SystemMemory.cs, ProcessStatsProvider.cs
- Internal/DataStructures/GenericSublist.cs, HashWheel.cs
- Internal/DataStructures/SubjectTree.cs, SubjectTreeNode.cs, SubjectTreeParts.cs

All 461 tests pass (460 unit + 1 integration). DB updated for features 2588-2592 and tests 2598-2614.

docs/plans/phases/phase6sessions/session-11.md

@@ -0,0 +1,52 @@
+# Session 11: Accounts & Directory Store
+
+## Summary
+
+Multi-tenancy account system and directory-based JWT store. Accounts manage per-tenant state including JetStream limits, imports/exports, and user authentication.
+
+## Scope
+
+| Go File | Features | Feature IDs | Go LOC |
+|---------|----------|-------------|--------|
+| server/accounts.go | 200 | 150–349 | 3,918 |
+| server/dirstore.go | 34 | 793–826 | 575 |
+| **Total** | **234** | | **4,493** |
+
+## .NET Classes
+
+- `Account` — per-tenant account with limits, imports, exports
+- `DirectoryAccountResolver` — file-system-based account resolver
+- `CacheDirAccountResolver` — caching resolver wrapper
+- `MemoryAccountResolver` — in-memory resolver
+- `UriAccountResolver` — HTTP-based resolver
+- `DirJwtStore` — JWT file storage
+- `DirectoryStore` — directory abstraction
+- `ExpirationTracker` — JWT expiration tracking
+- `LocalCache` — local account cache
+- `ServiceExport`, `ServiceImport`, `ServiceLatency` — service mesh types
+
+## Test Files
+
+| Test File | Tests | Test IDs |
+|-----------|-------|----------|
+| server/accounts_test.go | 65 | 46–110 |
+| server/dirstore_test.go | 19 | 278–296 |
+| **Total** | **84** | |
+
+## Dependencies
+
+- Session 01 (Foundation Types)
+- Session 02 (Utilities)
+- Session 03 (Configuration)
+- Session 05 (Subscription Index)
+- Session 06 (Auth & JWT)
+
+## .NET Target Location
+
+- `dotnet/src/ZB.MOM.NatsNet.Server/Accounts/`
+
+## Notes
+
+- `Account` is the 4th largest class (4.5K LOC across multiple Go files)
+- accounts.go alone has 200 features — will need methodical batching within the session
+- Account methods are spread across accounts.go, consumer.go, events.go, jetstream.go, etc. — this session covers only accounts.go features