Implement QUIC transport, sessions, and authentication

[zoeyrose]

Outcome

Implement the secure, bounded Game Protocol 1 transport for the Go server over QUIC, using generated contracts from atrinik/protocol.

This is not gRPC gameplay transport and has no compatibility mode for the classic socket protocol.

Transport contract

• Pin the approved Go QUIC implementation and TLS policy.
• Use the protocol-owned ALPN, handshake, version/capability negotiation, framing, stream roles, error codes, and reconnect semantics.
• Separate reliable ordered control/state streams from any approved latency-sensitive delivery; document why each message class uses its channel.
• Enforce exact byte, message, nesting, collection, queue, and rate limits before committing state.
• Apply bounded backpressure and fair per-session scheduling; bulk resource delivery cannot starve gameplay.
• Authenticate server identity. Define client trust-on-first-use, configured trust, and certificate-rotation behavior explicitly.
• Decode into temporary validated structures; malformed, duplicate, stale, or out-of-order messages cannot partially mutate a session.

Session and authentication scope

• Pre-auth connection lifecycle and abuse throttling.
• Account authentication handoff to the account service without logging secrets.
• Session IDs, reconnect/resume tokens, expiry, revocation, duplicate login policy, and character attachment.
• Capability/version rejection with actionable client diagnostics.
• Graceful drain and disconnect semantics.

Verification

• Go/Rust golden interoperability tests from the same protocol descriptors.
• Fuzz truncated, oversized, deeply nested, unknown-field, duplicate, and invalid-state inputs.
• Test slow readers/writers, connection churn, cancellation, stream reset, handshake timeout, replayed credentials, queue pressure, and server shutdown.
• Metrics have bounded labels and never include account names, tokens, addresses at unbounded cardinality, or message contents.
• A wrapper topology connects a minimal generated Rust client and completes handshake/authentication in isolation.

Dependencies and parallel work

Requires the protocol framing/session issues and simulation command boundary. Account persistence may be stubbed initially behind its interface. Resource streaming is a separate protocol/client/server issue but must use this scheduler.