feat: port session 07 — Protocol Parser, Auth extras (TPM/certidp/certstore), Internal utilities & data structures

Session 07 scope (5 features, 17 tests, ~1165 Go LOC):
- Protocol/ParserTypes.cs: ParserState enum (79 states), PublishArgument, ParseContext
- Protocol/IProtocolHandler.cs: handler interface decoupling parser from client
- Protocol/ProtocolParser.cs: Parse(), ProtoSnippet(), OverMaxControlLineLimit(),
  ProcessPub/HeaderPub/RoutedMsgArgs/RoutedHeaderMsgArgs, ClonePubArg(), GetHeader()
- tests/Protocol/ProtocolParserTests.cs: 17 tests via TestProtocolHandler stub

Auth extras from session 06 (committed separately):
- Auth/TpmKeyProvider.cs, Auth/CertificateIdentityProvider/, Auth/CertificateStore/

Internal utilities & data structures (session 06 overflow):
- Internal/AccessTimeService.cs, ElasticPointer.cs, SystemMemory.cs, ProcessStatsProvider.cs
- Internal/DataStructures/GenericSublist.cs, HashWheel.cs
- Internal/DataStructures/SubjectTree.cs, SubjectTreeNode.cs, SubjectTreeParts.cs

All 461 tests pass (460 unit + 1 integration). DB updated for features 2588-2592 and tests 2598-2614.

dotnet/tests/ZB.MOM.NatsNet.Server.Tests/Auth/CertificateIdentityProvider/CertificateIdentityProviderTests.cs

@@ -0,0 +1,39 @@
+using Shouldly;
+using ZB.MOM.NatsNet.Server.Auth.CertificateIdentityProvider;
+
+namespace ZB.MOM.NatsNet.Server.Tests.Auth.CertificateIdentityProvider;
+
+/// <summary>
+/// Tests for the certidp module, mirroring certidp_test.go and ocsp_responder_test.go.
+/// </summary>
+public sealed class CertificateIdentityProviderTests
+{
+    [Theory]
+    [InlineData(0, "good")]
+    [InlineData(1, "revoked")]
+    [InlineData(2, "unknown")]
+    [InlineData(42, "unknown")] // Invalid → defaults to unknown (never good)
+    public void GetStatusAssertionStr_ShouldMapCorrectly(int input, string expected)
+    {
+        // Mirror: TestGetStatusAssertionStr
+        OcspStatusAssertionExtensions.GetStatusAssertionStr(input).ShouldBe(expected);
+    }
+
+    [Fact]
+    public void EncodeOCSPRequest_ShouldProduceUrlSafeBase64()
+    {
+        // Mirror: TestEncodeOCSPRequest
+        var data = "test data for OCSP request"u8.ToArray();
+        var encoded = OcspResponder.EncodeOCSPRequest(data);
+
+        // Should not contain unescaped base64 chars that are URL-unsafe.
+        encoded.ShouldNotContain("+");
+        encoded.ShouldNotContain("/");
+        encoded.ShouldNotContain("=");
+
+        // Should round-trip: URL-unescape → base64-decode → original bytes.
+        var unescaped = Uri.UnescapeDataString(encoded);
+        var decoded = Convert.FromBase64String(unescaped);
+        decoded.ShouldBe(data);
+    }
+}