feat(network): lean base pools (#2641)

**Follow-on to #2639 (merged). References a local IORingGroup `1.0.13-preview.11` pack until 1.0.13 (modernuo/IORingGroup#15) is published; do not merge before that switch.**

## Summary

Consumes IORingGroup's lean base pools (modernuo/IORingGroup#15): both network pools now start with one slab, grow a slab at a time with the population, and trim idle slabs back after quiet periods.

- Fixes the transport's send-pool cap: previously only 1024 of the 4096 connections could get a send buffer; connection 1025 was closed at accept.
- Network memory at boot drops from about 96 MB to about 10 MB at the defaults; a full 4096 logged-in connections is about 1.25 GB of base buffers plus the growth budget.
- New settings: `network.initialBufferSlabs` (default 1; slabs of each pool held from boot and the trim floor) and `network.maxBufferSlabs` (default 128; divides the connection maximum into slabs, 32 connections per slab). Both are coerced with a warning; the same value feeds the ring table and the manager so they cannot drift.
- The Debug-only maintenance line includes base-pool capacity and releases.
- `dev-docs/server-requirements.md` rewrites the network memory story and adds the two settings.

## Pre-auth buffers

Every connection starts on the transport's platform-minimum buffers (4 KB receive, 4 KB send) instead of the base pools. It is promoted to full-size buffers (64 KB receive, `network.sendBufferSize` send) when the game server verifies its account — the point where `NetState.Account` is assigned in the `GameServer_AwaitingGameServerLogin` or `GameServer_LoggedIn` state, so a verdict that lands after the parser has moved on still promotes. Nothing ever moves back. The login-server pass stays on the small buffers for its whole lifetime.

Before credentials verify, nothing promotes: the 4 KB send ring is the entire pre-auth send budget, and a connection that overruns it is dropped as exhausted, exactly as the receive side drops a packet header declaring more bytes than the receive buffer can hold (new guard in `HandlePacket`; it also closes the old 65535-byte edge on 64 KB buffers). The stock login sequence sends under 2 KB. After credentials verify, the send path promotes on demand if it ever needs to (unbudgeted, outside the memory ceiling and the shrink bookkeeping — promotion is not growth), and the oversize-packet guard waits on a pending receive promotion or retries a stalled one once for a verified account before disconnecting. A completion that fills the receive buffer arms no receive, so `HandleReceive` now calls `RingSocket.ResumeReceive()` after the parse loop — at 4 KB a burst of small packets fills the buffer in one completion.

Net effect: a flood of unauthenticated connections tops out at about 32 MB across the full 4096-connection cap where the platform minimum is 4 KB (the transport's retained slabs and the base pools used by logged-in players are separate), and never allocates a base-pool slab.

Platform note: on Windows Server 2012 R2 / 2016 the transport's legacy mapping path floors at 64 KB: the pre-auth receive pool is off there (its base is 64 KB), while the pre-auth send buffer starts at 64 KB under the 256 KB base. The server logs the effective sizes at startup.

## Testing

Server.Tests (905) and UOContent.Tests green on the preview pack (one pre-existing `FamiliarAITests` failure from #2644 reproduces on `main`, tracked separately). New tests cover both coercions, that the ring's registration table equals `RequiredRegisteredBuffers` for the configured values, promotion on game-server auth and on a late account, no promotion on the login server, pre-credential overrun ending in exhaustion, post-credential on-demand promotion, the oversize-packet guard through loopback (error, wait, retry with an account, and a promotion made pending mid-parse), and receiving again after a burst fills the initial buffer.

Projects/Server/Network/NetState/NetState.cs

@@ -227,7 +227,39 @@ public partial class NetState : IComparable<NetState>, IValueLinkListNode<NetSta
     public IAccount Account
     {
         get => _account;
-        set => _account = value;
+        set
+        {
+            _account = value;
+
+            // 0x91 credentials just verified: the character list and the world-entry burst follow.
+            // The login-server pass stays on the initial buffers; it never sends more than a server list.
+            // An off-loop password check can land its verdict after HandleReceive already flipped the
+            // state to LoggedIn, so both states promote; both calls below are no-ops once applied.
+            if (value != null && _protocolState is ProtocolState.GameServer_AwaitingGameServerLogin or ProtocolState.GameServer_LoggedIn)
+            {
+                PromoteBuffers();
+            }
+        }
+    }
+
+    private void PromoteBuffers()
+    {
+        if (_socket == null)
+        {
+            return;
+        }
+
+        if (!_socketManager.TryPromoteSendBuffer(_socket) && _socket.SendBuffer.PhysicalSize < SendBufferSize)
+        {
+            // The send path promotes on demand and disconnects if that fails too
+            logger.Debug("{NetState}: send buffer promotion deferred to the send path", this);
+        }
+
+        if (!_socketManager.TryPromoteRecvBuffer(_socket) && _socket.RecvBuffer.PhysicalSize < RecvBufferSize)
+        {
+            // The oversize-packet guard in HandlePacket gets one more try where the small buffer matters
+            logger.Debug("{NetState}: recv buffer promotion deferred", this);
+        }
     }
 
     public string Assistant { get; set; }
@@ -525,6 +557,19 @@ public partial class NetState : IComparable<NetState>, IValueLinkListNode<NetSta
             return false;
         }
 
+        if (_socket.SendBuffer.PhysicalSize < SendBufferSize)
+        {
+            // Promotion is unbudgeted and is not growth, so neither the ceiling nor the shrink
+            // bookkeeping applies. Before credentials verify nothing promotes: the 4 KiB ring is the
+            // whole pre-auth send budget, and a connection that exceeds it is dropped as exhausted.
+            if (_account == null)
+            {
+                return false;
+            }
+
+            return _socketManager.TryPromoteSendBuffer(_socket);
+        }
+
         if (!UnderMemoryCeiling())
         {
             _ceilingRefusals++;
@@ -1084,6 +1129,13 @@ public partial class NetState : IComparable<NetState>, IValueLinkListNode<NetSta
                     break;
                 }
             }
+
+            // A completion that fills the buffer arms no receive; whatever the loop consumed is free
+            // space again. No-op while a receive is armed or the buffer is still full.
+            if (_running)
+            {
+                _socket.ResumeReceive();
+            }
         }
         catch (Exception ex)
         {
@@ -1137,6 +1189,22 @@ public partial class NetState : IComparable<NetState>, IValueLinkListNode<NetSta
             }
         }
 
+        // Can never complete: the buffer holds PhysicalSize - 1 bytes (one slot tells full from
+        // empty) and a recv arms only into free space
+        if (packetLength >= _socket.RecvBuffer.PhysicalSize)
+        {
+            // A verified account whose promotion could not be applied earlier gets one more try here,
+            // where the small buffer actually matters; the swap lands before the next completion's event
+            if (_account != null && _socket.RecvBuffer.PhysicalSize < RecvBufferSize &&
+                _socketManager.TryPromoteRecvBuffer(_socket))
+            {
+                return ParserState.AwaitingPartialPacket;
+            }
+
+            LogInfo($"Received packet 0x{packetId:X2} declaring {packetLength} bytes, more than the receive buffer holds.");
+            return ParserState.Error;
+        }
+
         // Not enough data, let's wait for more to come in
         if (length < packetLength)
         {