* test(quic): expand connection.cpp branch coverage

Drives the private dispatch helpers of
src/protocols/quic/connection.cpp through a new test-only friend
class tests::support::quic_connection_test_access (gated by
NETWORK_ENABLE_TEST_INJECTION) so the std::visit arms of
handle_frame, plus process_frames / build_packet /
generate_ack_frame / handle_loss_detection_result /
generate_probe_packets / queue_frames_for_retransmission /
update_state, are reachable under -fprofile-arcs -ftest-coverage
without waiting on the TLS handshake (which exceeds wait_for(3s)
per PR #1111 diagnosis).

Coverage areas added:
- handle_frame std::visit arms: padding, ping, ack (with seeded
  sent_packets to exercise the erase loop), crypto, max_data,
  max_stream_data, max_streams (bidi + uni), connection_close
  (transport + application), handshake_done (client connected +
  server no-op), reset_stream / stop_sending unknown-stream arms,
  new_connection_id, retire_connection_id error propagation,
  data_blocked / stream_data_blocked / streams_blocked /
  path_challenge / path_response / new_token catch-all arm.
- process_frames empty + malformed payload dispatch.
- build_packet no-keys early-return for all encryption levels.
- generate_ack_frame nullopt vs populated arms (largest_received
  zero with ack_needed true exercises the OR-branch).
- get_pn_space switch arms for both const and non-const overloads
  including the initial / zero_rtt aliasing.
- update_state no-op when handshake not complete.
- close / close_application re-entry guards (already closing,
  draining, closed).
- enter_closing / enter_draining no-op arms.
- on_timeout drain-timeout, idle-timeout, no-timeout.
- next_timeout closed (nullopt) + draining (drain_deadline) arms.
- handle_loss_detection_result: none, pto_expired (asserts PING
  frame appended), packet_lost (asserts pending_frames grew),
  ecn::congestion_signal, ecn::ecn_failure.
- generate_probe_packets encryption-level cascade with and without
  pending crypto data.
- queue_frames_for_retransmission per-variant arms: padding / ack
  (not requeued), crypto (per level routed to matching queue),
  stream (skipped), ping / new_token / handshake_done (requeued),
  flow-control frames (requeued), reset_stream / stop_sending
  (requeued), new_connection_id / retire_connection_id (requeued),
  path_challenge / path_response (skipped), connection_close
  (skipped).
- start_handshake error guards (server-side rejection, non-idle
  state rejection) and init_server_handshake client-side rejection.

src/internal/protocols/quic/connection.h change is additive only:
a forward declaration of the probe and a friend declaration, both
gated by #if defined(NETWORK_ENABLE_TEST_INJECTION). Production
builds with BUILD_TESTS=OFF compile byte-identical.

Pattern mirrors PR #1116 (http2_client_test_access) and PR #1135
(quic_socket_test_access).

Closes #1145

* test(quic): extend connection branch coverage with derived keys

Round 7 follow-up to the initial PR commit. Local coverage delta
on the first round measured 62.6% -> 72.9% line / 34.4% -> 40.1%
branch from the run-26200588035 artifact, short of the 80%/70%
gate. The remaining gap is concentrated in build_packet's
post-keys body, which is unreachable until initial keys are
derived. Adding:

- ConnectionBuildPacketInitialKeysTest: derives initial secrets
  via the public crypto().derive_initial_secrets() API (does not
  require init_client/init_server) so build_packet can be driven
  past the keys-result.is_err() early-return. Covers empty payload
  short-circuit, pending CRYPTO assembly, ACK frame assembly,
  CONNECTION_CLOSE assembly, pending_frames emission, generate_packets
  pendng-crypto path, generate_packets close_sent path, and
  generate_packets after closed.

- generate_packets state-guard arms (idle, connected without data).

- next_timeout idle-deadline path with no loss-detector timeout.

- receive_packet draining and closed state arms (bytes/packets
  counters increment but no processing).

- on_timeout no-timeout idle arm.

All additions are header-include-only test cases routed through
the existing quic_connection_test_access probe; no further
src/ change required.