Part of #953

What

Raise line coverage of src/protocols/quic/crypto.cpp from 59.5% to >= 80%, and branch coverage from 22.5% to >= 70%.

Current state (2026-04-17 measurement, source PR #989):

• Instrumented lines: 546 / ~1270 LOC
• Lines hit: 325 / 546 (59.5%)
• Branches: 239 / 1060 (22.5%)
• Existing tests: tests/unit/quic_crypto_test.cpp — 426 LOC, 25 GTEST cases

Line coverage is the highest of the top-5 (already past halfway), but branch coverage at 22.5% of 1060 branches indicates extensive error-path dead-code or untested algorithmic variants (cipher suites, key derivation phases, packet-number-encryption edge cases).

Why

• Cryptographic code must be validated against a wide range of adversarial inputs; uncovered branches in a TLS/QUIC crypto path are latent correctness/security risks.
• Closer to target than the other top-5 files; moderate priority.

Where

• Source: src/protocols/quic/crypto.cpp
• Existing tests to extend: tests/unit/quic_crypto_test.cpp

How

Approach

1. From PR ci(coverage): enable messaging_bridge in coverage build #989 artifact, list every uncovered branch — group by: cipher negotiation, AEAD encrypt/decrypt error returns, HKDF failures, key update flow, retry integrity tag validation.
2. Add RFC 9001 test vectors for packet-number encryption where the existing corpus is thin.
3. Add negative tests that confirm the code rejects tampered or replayed packets (AEAD auth-tag mismatch branch).

Acceptance Criteria

• src/protocols/quic/crypto.cpp line coverage >= 80%
• src/protocols/quic/crypto.cpp branch coverage >= 70%
• New tests live in tests/unit/quic_crypto_test.cpp or split by concern
• All tests pass on Ubuntu/macOS CI
• ASAN/UBSAN all green

Dependencies

• Parent: Expand unit test coverage from 40% to 80% #953
• Prerequisite: PR ci(coverage): enable messaging_bridge in coverage build #989 — merged.