feat: port session 07 — Protocol Parser, Auth extras (TPM/certidp/certstore), Internal utilities & data structures

Session 07 scope (5 features, 17 tests, ~1165 Go LOC):
- Protocol/ParserTypes.cs: ParserState enum (79 states), PublishArgument, ParseContext
- Protocol/IProtocolHandler.cs: handler interface decoupling parser from client
- Protocol/ProtocolParser.cs: Parse(), ProtoSnippet(), OverMaxControlLineLimit(),
  ProcessPub/HeaderPub/RoutedMsgArgs/RoutedHeaderMsgArgs, ClonePubArg(), GetHeader()
- tests/Protocol/ProtocolParserTests.cs: 17 tests via TestProtocolHandler stub

Auth extras from session 06 (committed separately):
- Auth/TpmKeyProvider.cs, Auth/CertificateIdentityProvider/, Auth/CertificateStore/

Internal utilities & data structures (session 06 overflow):
- Internal/AccessTimeService.cs, ElasticPointer.cs, SystemMemory.cs, ProcessStatsProvider.cs
- Internal/DataStructures/GenericSublist.cs, HashWheel.cs
- Internal/DataStructures/SubjectTree.cs, SubjectTreeNode.cs, SubjectTreeParts.cs

All 461 tests pass (460 unit + 1 integration). DB updated for features 2588-2592 and tests 2598-2614.

docs/plans/phases/phase6sessions/session-15.md

@@ -0,0 +1,45 @@
+# Session 15: Leaf Nodes
+
+## Summary
+
+Leaf node connections — lightweight connections from edge servers to hub servers. Simpler than full routes but with subject interest propagation.
+
+## Scope
+
+| Go File | Features | Feature IDs | Go LOC |
+|---------|----------|-------------|--------|
+| server/leafnode.go | 71 | 1979–2049 | 3,091 |
+| **Total** | **71** | | **3,091** |
+
+## .NET Classes
+
+- `LeafNodeHandler` — leaf node connection management
+- `LeafNodeCfg` — leaf node configuration
+- `LeafNodeOption` — leaf node reload option
+- `ClientConnection` (partial — leafnode-specific methods)
+
+## Test Files
+
+| Test File | Tests | Test IDs |
+|-----------|-------|----------|
+| server/leafnode_test.go | 111 | 1906–2016 |
+| server/leafnode_proxy_test.go | 9 | 1897–1905 |
+| **Total** | **120** | |
+
+## Dependencies
+
+- Session 01 (Foundation Types)
+- Session 07 (Protocol Parser)
+- Session 08 (Client Connection)
+- Session 09 (Server Core Part 1)
+- Session 14 (Routes — shared routing infrastructure)
+
+## .NET Target Location
+
+- `dotnet/src/ZB.MOM.NatsNet.Server/LeafNode/`
+
+## Notes
+
+- 111 + 9 = 120 tests — this is a test-heavy session
+- Leaf nodes support TLS, auth, and subject deny lists
+- WebSocket transport for leaf nodes adds complexity