feat(batch43): implement account resolvers and service latency tracking

Implements 37 deferred features from Batch 43:

Group A - Type methods:
- ServiceRespType.String: already existed via ToNatsString extension
- NewMapDest: already existed as MapDest.New factory
- ServiceLatency.merge → ServiceLatencyExtensions.Merge + Sanitize

Group B - Tracing headers (new TracingHeaders static class in AccountTypes.cs):
- newB3Header → TracingHeaders.NewB3Header
- newUberHeader → TracingHeaders.NewUberHeader
- newTraceCtxHeader → TracingHeaders.NewTraceCtxHeader
- shouldSample → TracingHeaders.ShouldSample

Group C - Service export timers (new extension methods in AccountTypes.cs):
- serviceImport.isRespServiceImport → ServiceImportEntryExtensions.IsRespServiceImport
- serviceExport.setResponseThresholdTimer → ServiceExportEntryExtensions.SetResponseThresholdTimer
- serviceExport.clearResponseThresholdTimer → ServiceExportEntryExtensions.ClearResponseThresholdTimer
- serviceExport.checkExpiredResponses → ServiceExportEntryExtensions.CheckExpiredResponses

Group D - Latency & client updates:
- sanitizeLatencyMetric → ServiceLatencyExtensions.SanitizeLatencyMetric
- updateAllClientsServiceExportResponseTime → ServiceExportClientHelpers.UpdateAllClientsServiceExportResponseTime
- ClientConnection.UpdateRrTrackingThreshold (helper for above)

Group E - Account resolvers (NatsServer.AccountResolvers.cs):
- authAccounts → NatsServer.AuthAccounts
- Server.SetAccountResolver + GetAccountResolver
- Server.UpdateAccountClaims + UpdateAccountClaimsWithRefresh
- buildPermissionsFromJwt → NatsServer.BuildPermissionsFromJwt (with JwtPermissions stub types)
- buildInternalNkeyUser → NatsServer.BuildInternalNkeyUser (with JwtUserClaims stub type)
- fetchAccount → NatsServer.FetchAccountFromResolverAsync
- respondToUpdate → NatsServer.RespondToUpdate (with ClaimUpdateResponse/Status/Error types)
- handleListRequest → NatsServer.HandleListRequest
- handleDeleteRequest → NatsServer.HandleDeleteRequest
- getOperatorKeys → NatsServer.GetOperatorKeys
- claimValidate → NatsServer.ClaimValidate
- removeCb → NatsServer.RemoveCb

Group F - Directory resolvers:
- Server.fetch → NatsServer.ServerFetch (stub falls back to direct resolver)
- DirAccResolver.Fetch, NewDirAccResolver, FetchTimeout already in AccountResolver.cs
- NewCacheDirAccResolver, CacheDirAccResolver.Reload already in AccountResolver.cs

Supporting changes:
- Account.cs: expose ExpiredTimeout as internal, add ReadLock/ReadUnlock/WriteLock/WriteUnlock
  helpers plus GetResponseCount/GetResponseEntries for CheckExpiredResponses
- AccountTypes.cs: add using System.Globalization for hex parsing
- NatsServerTypes.cs: add AccountClaims.Name property (JWT name tag)

dotnet/src/ZB.MOM.NatsNet.Server/ClientConnection.cs

@@ -1807,6 +1807,25 @@ public sealed partial class ClientConnection
     internal bool IsWebSocket() => Ws != null;
     internal bool IsHubLeafNode() => Kind == ClientKind.Leaf && Leaf?.IsSpoke != true;
     internal string RemoteCluster() => Leaf?.RemoteCluster ?? string.Empty;
+
+    /// <summary>
+    /// Updates the response-round-trip tracking threshold on this client when it
+    /// differs from <paramref name="lowestResponseThreshold"/>, and resets the
+    /// pending-timer to the new value.
+    /// Mirrors Go logic in <c>updateAllClientsServiceExportResponseTime</c> for a
+    /// single client (accounts.go ~line 1527).
+    /// </summary>
+    internal void UpdateRrTrackingThreshold(TimeSpan lowestResponseThreshold)
+    {
+        lock (_mu)
+        {
+            if (_rrTracking == null || _rrTracking.Lrt == lowestResponseThreshold)
+                return;
+
+            _rrTracking.Lrt = lowestResponseThreshold;
+            _rrTracking.Ptmr?.Change(lowestResponseThreshold, Timeout.InfiniteTimeSpan);
+        }
+    }
 }
 
 // ============================================================================