Add framework resource policies and descriptor streaming

[VolkerChristian]

Summary

This PR moves reusable transport, resource, and platform policy into SNode.C so applications can remain focused on protocol semantics and application policy.

• add shared HTTP parser limits for server requests and client responses
• add HTTP server pending-request, chunked-transfer, and pipelining policy
• add descriptor-based FileReader openat() and explicit descriptor adoption
• add HTTP/Express Response::pipe(Source*) streaming with backpressure and error lifecycle handling
• add bounded SocketWriter queues, high/low watermarks, and result-returning queue admission
• add WebSocket frame, message, and fragment limits with close code 1009
• add portable Unix peer-credential reporting through SO_PEERCRED or getpeereid()
• document the configuration hierarchy, CLI/config-file options, defaults, APIs, and migration requirements

Motivation

Applications currently duplicate queue accounting, descriptor streaming, parser admission limits, WebSocket resource limits, and platform-specific Unix credential queries. Centralizing these mechanics makes future applications canonical SNode.C applications without moving authorization, HTTP semantics, or trust decisions into the framework.

Compatibility and migration

This release intentionally starts a new SNode.C C++ API/ABI epoch. The existing release model derives SOVERSION from the project major version, so the project is now version 2.0.0 and all SNode.C shared libraries use SOVERSION 2. Applications, plugins, and libraries built against SNode.C 1.x must be rebuilt; 1.x and 2.0 C++ libraries must not be mixed in one process.

Defaults preserve existing runtime behavior after rebuilding, without configuration changes. Existing source APIs remain available where compatible.

The installed public class layouts and SocketConnection virtual interface changed. FileReader::open(...) failures may now return nullptr, so callers must check the returned pointer before dereferencing or piping; later asynchronous streaming failures continue through the Source/Sink lifecycle. Full affected-area and before/after guidance is in docs/migration-2.0.md.

The test-only SocketWriterTestAccess helper has been removed from the installed public header. Its tests now use a test subclass and the real EventLoop write path, without changing SocketWriter runtime behavior.

openat() lookup is explicitly not presented as filesystem confinement, and peer credentials report verified facts only. No WebSocket sender tuning option was added because there is no concrete deployment requirement.

Validation

• cmake --build build-p0 --target all --parallel 24
• focused P0 tests: 12/12 passed
• installed consumer test: 1/1 passed; installed CMake metadata reports 2.0.0/SOVERSION 2 and installed libraries have SONAME .so.2
• installed headers contain no SocketWriterTestAccess
• ctest --test-dir build-p0 --output-on-failure --parallel 24
• full suite: 181/181 passed

No AISuite, codex-backend, MQTTSuite, or external application files are changed. The P0 architecture and runtime policy implementations were not redesigned during finalization.