…t of #1062) (#1076)

* test(http2): drive connected-state paths via mock_h2_server_peer

Adds 12 new TEST_F cases under Http2ClientHermeticTransportTest in
tests/unit/http2_client_branch_test.cpp that compose the Phase 2A
mock_h2_server_peer (PR #1075) to bring http2_client into a fully
SETTINGS-exchanged state, then exercise public methods that early-
returned via is_connected() in the existing disconnected-state suite.

Newly reached paths in src/protocols/http2/http2_client.cpp:
- connect() second-call short-circuit through already_exists branch
- send_request() / get() / post() create_stream + build_headers +
  encoder_.encode + send_frame on the connected path, terminating in
  the future timeout branch (peer sends no HEADERS+DATA in 2A)
- start_stream() / write_stream() / cancel_stream() /
  close_stream_writer() connected paths plus their not_found error
  branches with an unallocated stream id
- close_stream_writer() idempotent early-return on a half_closed_local
  stream
- set_settings() post-handshake call site updating encoder / decoder
  table sizes
- disconnect() GOAWAY emit + stop_io path followed by the second-call
  early-return on a torn-down handshaken client

HEADERS+DATA reply paths remain unreachable until Phase 2A.2 of #1074
lands; this PR therefore uses Part of #1062, not Closes.

Part of #1062
Part of #953

* test(http2): qualify http_header in new lambda signatures

The four lambdas added in the prior commit used the bare identifier
http_header in their parameter list, which macOS clang flags as
'use of undeclared identifier' because the namespace alias
'namespace http2 = kcenon::network::protocols::http2;' inside the
test file does not implicitly bring symbols of that namespace into
unqualified lookup at the function signature site.

Switch all four occurrences to http2::http_header to match the
existing qualified usage at line 60 of the file.

… of #1063) (#1077)

Adds 12 TEST_F cases under the existing GrpcClientHermeticTransportTest
fixture that compose mock_h2_server_peer (PR #1075) to bring grpc_client
into a fully SETTINGS-exchanged state, then drive previously-unreachable
post-connect public methods.

Newly reached paths in src/protocols/grpc/client.cpp:
  - is_connected() compound condition after the http2 SETTINGS exchange
  - wait_for_connected() polling loop hitting the success branch
  - second connect() short-circuit through the already_connected branch
  - target() getter post-handshake
  - call_raw() connected path: header build, grpc-timeout header,
    metadata loop, http2_client::post forwarding, future timeout error
  - call_raw() post-connect deadline-exceeded branch
  - call_raw_async() connected submit_task + callback delivery
  - server_stream_raw / client_stream_raw / bidi_stream_raw connected
    paths: header build, start_stream forwarding, shared_*_holder
    allocation, ok() unique_ptr return
  - disconnect() second-call idempotent path after a real handshake

HEADERS+DATA reply paths still depend on Phase 2A.2 of #1074, so this
PR uses Part of #1063 / Part of #953, not Closes.

…2C of #1074) (#1103)

Add server-side QUIC Initial echo peer to tests/support/. The peer
receives one client Initial datagram, derives QUIC v1 initial keys
from the original DCID (RFC 9001 Section 5.2), and replies with a
header-protected server Initial carrying a stub crypto_frame
(type 0x06). This makes quic_socket::process_crypto_frame reachable
from a hermetic test for the first time, unblocking coverage
expansion under #1062 / #1065.

Phase 2A (#1075) and 2B (#1102) shipped HTTP/2 and gRPC peers; this
follows the same RAII shape: shared io_context, dedicated worker
thread, atomic state flags polled via wait_for. Phase 2D (friend-
test injection) and 2E (frame_injector) remain open under #1074.

Files:
- tests/support/mock_quic_peer_loop.{h,cpp} (new)
- tests/support/CMakeLists.txt (+1)
- tests/support/README.md (+1)
- tests/unit/quic_socket_branch_test.cpp (+46) -- one demo TEST_F

Part of #1074

…#1104)

Add friend-test injection so unit tests can drive two private
server-side methods previously unreachable from public APIs:

- messaging_quic_server::handle_packet
  (src/internal/experimental/quic_server.h:432)
- messaging_ws_server::handle_new_connection
  (src/internal/http/websocket_server.h:415)

Mechanism: new compile definition NETWORK_ENABLE_TEST_INJECTION
gated behind BUILD_TESTS in cmake/network_system_targets.cmake.
The two production headers gain a forward declaration block and
a single 'friend class' line, all wrapped in
'#if defined(NETWORK_ENABLE_TEST_INJECTION)'. When BUILD_TESTS=OFF
the production binary is byte-identical to the previous develop tip.

Probe types live entirely in tests/support/:
- network_test_friends.h forward-declares the probes
- quic_server_probe.{h,cpp} forwards to handle_packet
- ws_server_probe.{h,cpp} forwards to handle_new_connection

Demo tests verify end-to-end wiring:
- QuicServerProbeTest.HandlePacket{Empty,Garbage}BufferDoesNotCrash
- WsServerProbeTest.HandleNewConnectionEarlyReturnNoSessionManager
- WsServerProbeTest.HandleNewConnectionEmptySocketEarlyReturn

Per #1074 scope: no behavioral changes to src/. Phases 2A (#1075),
2A.2 (#1082), 2B (#1102), 2C (#1103) merged; 2E remains.

Part of #1074