What

Add unit tests for HTTP/2 (4), session (3), and tracing (3) modules — 10 modules with zero coverage.

Part of #953

Why

• HPACK and HTTP/2 framing bugs are historically a common source of protocol vulnerabilities
• Session modules hold long-lived state — regressions produce subtle leaks and auth failures
• Tracing modules emit data consumed by observability tooling; output-format drift breaks dashboards

Where

Target modules (10)

HTTP/2 (4):

• hpack (static/dynamic table encoding/decoding)
• http2_client
• http2_server
• (framing layer if separate)

Session (3):

• messaging_session
• quic_session
• secure_session

Tracing (3):

• exporters (OTLP, Jaeger, Zipkin)
• span (lifecycle, timing, attributes)
• trace_context (W3C propagation)

How

Technical Approach

1. HPACK: round-trip property tests with known RFC 7541 fixtures
2. Sessions: FSM tests covering open → active → drain → closed transitions
3. Tracing: golden-file comparison for exporter output

Acceptance Criteria

• All 10 modules have dedicated unit test files
• HPACK tests cover the RFC 7541 reference vectors
• Session lifecycle transitions are exhaustively tested
• Trace context propagation verified against W3C TraceContext spec fixtures
• Coverage >= 75% for affected modules
• All sanitizer builds pass