Closes #1033

What

Adds tests/unit/quic_frame_extra_coverage_test.cpp with 63 additional unit tests for src/protocols/quic/frame.cpp, complementing the existing quic_frame_coverage_test.cpp (Issue #1011) and quic_frame_types_test.cpp (Issue #974).

Why

src/protocols/quic/frame.cpp is one of the lowest-coverage source files in src/protocols/ per the #953 audit. The uncovered region concentrates in error and boundary paths -- exactly the surfaces that regress during the ongoing Result<T> migration. The existing coverage tests handle the common paths, but several branches and edge cases remained untouched: longer varint type prefixes, the non-zero ranges ACK accumulation loop, the non-zero CRYPTO offset path, CONNECTION_CLOSE with non-empty reason / non-zero frame_type / multi-byte error_code, the per-bit consistency of stream-flag helpers, and most frame_type_to_string branches.

Where

• New file: tests/unit/quic_frame_extra_coverage_test.cpp (63 tests, gtest)
• tests/CMakeLists.txt: registered network_quic_frame_extra_coverage_test next to the other extra_coverage tests
• CHANGELOG.md and docs/CHANGELOG.md: one-line entry each under [Unreleased] > Added
• Source under test (src/protocols/quic/frame.cpp): NOT MODIFIED

How

New test scope

• peek_type: 4-byte and 8-byte varint type prefixes
• parse_all: heterogeneous frame mix (PING + HANDSHAKE_DONE + MAX_DATA + PATH_CHALLENGE) and mid-sequence parse-error surfacing
• parse_padding: empty buffer rejected at parse() entry
• parse_ack: ACK_ECN dispatch via parse(), large delay / largest_acknowledged at varint boundaries, multi-range accumulation through the parse_ack loop, truncation at range gap, range length, ECT(1), and ECN-CE
• parse_stream: every concrete type byte 0x08..0x0f routed through parse() covering the FIN/LEN/OFF flag matrix, large stream_id varint, zero-length data with LEN flag
• parse_crypto: non-zero offset and 200-byte payload round-trips
• parse_new_token: empty-token and 150-byte token round-trips
• parse_new_connection_id: 1-byte CID minimum, 16384-sequence variant, cid_len=20 with insufficient remaining bytes
• parse_retire_connection_id: 4-byte varint sequence round-trip
• parse_path_challenge / parse_path_response: all-zero and all-0xFF payload round-trips
• parse_connection_close: transport-with-frame-type, application long-reason (120 chars forcing 2-byte length varint), multi-byte error_code
• parse_handshake_done: dispatch consumes exactly 1 byte, trailing buffer untouched
• frame_builder::build_padding(0): zero-count guard returns empty vector
• frame_type_to_string: 18 previously-unasserted branches
• is_stream_frame / get_stream_flags / make_stream_type: per-bit consistency at boundaries 0x07, 0x08, 0x0f, 0x10

Test plan

• All tests are hermetic: no network, no filesystem, no sleeps. Hand-rolled byte sequences follow RFC 9000 wire format so error-path tests are independent of builder behavior.
• Source under test is unchanged; this is a test-only PR.
• Local C++ toolchain (cmake/ninja/make) is unavailable in the working environment, so local build verification was skipped per project convention -- relying on the multi-platform CI matrix (Ubuntu GCC/Clang, macOS, Windows MSVC, ASAN/TSAN/UBSAN).

Breaking changes

None. Test additions only.

Notes

• The existing quic_frame_coverage_test.cpp documents an asymmetry between build_ack (writes ranges.size() as ACK Range Count) and parse_ack (treats it as "additional gap/length pairs after First ACK Range"), causing any non-empty-ranges round-trip to fail. This PR continues to avoid round-trips with non-empty ranges in builder-produced inputs and instead validates the parse_ack range-loop branch by hand-crafted byte sequences. Fixing the divergence is out of scope for the test-expansion track.
• Coverage measurement against develop HEAD: deferred to CI (no local lcov toolchain).