feat(network): lean base pools (#2641)

**Follow-on to #2639 (merged). References a local IORingGroup `1.0.13-preview.11` pack until 1.0.13 (modernuo/IORingGroup#15) is published; do not merge before that switch.**

## Summary

Consumes IORingGroup's lean base pools (modernuo/IORingGroup#15): both network pools now start with one slab, grow a slab at a time with the population, and trim idle slabs back after quiet periods.

- Fixes the transport's send-pool cap: previously only 1024 of the 4096 connections could get a send buffer; connection 1025 was closed at accept.
- Network memory at boot drops from about 96 MB to about 10 MB at the defaults; a full 4096 logged-in connections is about 1.25 GB of base buffers plus the growth budget.
- New settings: `network.initialBufferSlabs` (default 1; slabs of each pool held from boot and the trim floor) and `network.maxBufferSlabs` (default 128; divides the connection maximum into slabs, 32 connections per slab). Both are coerced with a warning; the same value feeds the ring table and the manager so they cannot drift.
- The Debug-only maintenance line includes base-pool capacity and releases.
- `dev-docs/server-requirements.md` rewrites the network memory story and adds the two settings.

## Pre-auth buffers

Every connection starts on the transport's platform-minimum buffers (4 KB receive, 4 KB send) instead of the base pools. It is promoted to full-size buffers (64 KB receive, `network.sendBufferSize` send) when the game server verifies its account — the point where `NetState.Account` is assigned in the `GameServer_AwaitingGameServerLogin` or `GameServer_LoggedIn` state, so a verdict that lands after the parser has moved on still promotes. Nothing ever moves back. The login-server pass stays on the small buffers for its whole lifetime.

Before credentials verify, nothing promotes: the 4 KB send ring is the entire pre-auth send budget, and a connection that overruns it is dropped as exhausted, exactly as the receive side drops a packet header declaring more bytes than the receive buffer can hold (new guard in `HandlePacket`; it also closes the old 65535-byte edge on 64 KB buffers). The stock login sequence sends under 2 KB. After credentials verify, the send path promotes on demand if it ever needs to (unbudgeted, outside the memory ceiling and the shrink bookkeeping — promotion is not growth), and the oversize-packet guard waits on a pending receive promotion or retries a stalled one once for a verified account before disconnecting. A completion that fills the receive buffer arms no receive, so `HandleReceive` now calls `RingSocket.ResumeReceive()` after the parse loop — at 4 KB a burst of small packets fills the buffer in one completion.

Net effect: a flood of unauthenticated connections tops out at about 32 MB across the full 4096-connection cap where the platform minimum is 4 KB (the transport's retained slabs and the base pools used by logged-in players are separate), and never allocates a base-pool slab.

Platform note: on Windows Server 2012 R2 / 2016 the transport's legacy mapping path floors at 64 KB: the pre-auth receive pool is off there (its base is 64 KB), while the pre-auth send buffer starts at 64 KB under the 256 KB base. The server logs the effective sizes at startup.

## Testing

Server.Tests (905) and UOContent.Tests green on the preview pack (one pre-existing `FamiliarAITests` failure from #2644 reproduces on `main`, tracked separately). New tests cover both coercions, that the ring's registration table equals `RequiredRegisteredBuffers` for the configured values, promotion on game-server auth and on a late account, no promotion on the login server, pre-credential overrun ending in exhaustion, post-credential on-demand promotion, the oversize-packet guard through loopback (error, wait, retry with an account, and a promotion made pending mid-parse), and receiving again after a burst fills the initial buffer.

Projects/Server.Tests/Tests/Network/NetStateRecvGuardTests.cs

@@ -0,0 +1,236 @@
+using System;
+using System.Buffers;
+using System.Diagnostics;
+using System.Network;
+using System.Threading;
+using Server.Network;
+using Xunit;
+
+namespace Server.Tests.Network;
+
+[Collection("Sequential Server Tests")]
+public class NetStateRecvGuardTests
+{
+    private const byte TestPacketId = 0xB1;
+
+    private static unsafe void RegisterVariableLength()
+    {
+        if (IncomingPackets.GetHandler(TestPacketId) == null)
+        {
+            IncomingPackets.Register(TestPacketId, 0, false, &NoOp);
+        }
+    }
+
+    private static void NoOp(NetState state, SpanReader reader)
+    {
+    }
+
+    // Not 0x73: NetStateSendBufferTests registers its own no-op there first-come-wins, since the
+    // handler table is process-global, and this test needs its own handler's side effect to fire.
+    private const byte TestPingPacketId = 0x72;
+
+    private static byte _lastPing;
+
+    private static unsafe void RegisterNoOpPing()
+    {
+        if (IncomingPackets.GetHandler(TestPingPacketId) == null)
+        {
+            IncomingPackets.Register(TestPingPacketId, 2, false, &RecordPing);
+        }
+    }
+
+    private static void RecordPing(NetState state, SpanReader reader) => _lastPing = reader.ReadByte();
+
+    private const byte AttachAccountPacketId = 0x71;
+
+    private static unsafe void RegisterAttachAccount()
+    {
+        if (IncomingPackets.GetHandler(AttachAccountPacketId) == null)
+        {
+            IncomingPackets.Register(AttachAccountPacketId, 3, false, &AttachAccount);
+        }
+    }
+
+    // Stands in for the 0x91 handler: the account attaches mid-parse, so the promotion is pending
+    // with a receive armed when the next packet in the same completion reaches the guard
+    private static void AttachAccount(NetState state, SpanReader reader) => state.Account = new MockAccount();
+
+    private static void SliceUntil(Func<bool> done)
+    {
+        var deadline = Stopwatch.StartNew();
+        while (!done() && deadline.ElapsedMilliseconds < 5000)
+        {
+            NetState.Slice();
+            Thread.Sleep(5);
+        }
+
+        Assert.True(done());
+    }
+
+    [SkippableFact]
+    public void HandleReceive_PacketLongerThanTheRecvBuffer_IsAnError()
+    {
+        RegisterVariableLength();
+        var ns = PacketTestUtilities.CreateTestNetState(out var client);
+        try
+        {
+            // A 16-bit length cannot exceed a 64 KiB buffer, so the guard is unreachable there and
+            // this only ever hit the `< 3` check on a buffer that size.
+            Skip.If(ns._socket.RecvBuffer.PhysicalSize > ushort.MaxValue);
+
+            ns._protocolState = NetState.ProtocolState.GameServer_LoggedIn;
+
+            // A variable-length header claiming more than the buffer can ever hold would otherwise
+            // park the connection with nothing to arm a recv into
+            var declared = ns._socket.RecvBuffer.PhysicalSize; // one more than the buffer can ever hold
+            client.Send(new byte[] { TestPacketId, (byte)(declared >> 8), (byte)declared });
+            SliceUntil(() => ns._protocolState == NetState.ProtocolState.Error);
+
+            Assert.Contains("bad state", ns._disconnectReason);
+        }
+        finally
+        {
+            ns.Dispose();
+            client.Close();
+        }
+    }
+
+    [Fact]
+    public void HandleReceive_PacketThatFits_WaitsForTheRest()
+    {
+        RegisterVariableLength();
+        var ns = PacketTestUtilities.CreateTestNetState(out var client);
+        try
+        {
+            ns._protocolState = NetState.ProtocolState.GameServer_LoggedIn;
+
+            var declared = ns._socket.RecvBuffer.PhysicalSize / 2;
+            client.Send(new byte[] { TestPacketId, (byte)(declared >> 8), (byte)declared });
+            SliceUntil(() => ns._socket.RecvBuffer.ReadableBytes == 3);
+
+            Assert.Equal(NetState.ProtocolState.GameServer_LoggedIn, ns._protocolState);
+            Assert.True(ns.Running);
+            Assert.Equal(3, ns._socket.RecvBuffer.ReadableBytes);
+        }
+        finally
+        {
+            ns.Dispose();
+            client.Close();
+        }
+    }
+
+    [SkippableFact]
+    public void HandleReceive_OversizePacket_WithAnAccount_RetriesPromotionInsteadOfErroring()
+    {
+        Skip.If(NetState.InitialRecvBufferSize == 0);
+        RegisterVariableLength();
+        var ns = PacketTestUtilities.CreateTestNetState(out var client);
+        try
+        {
+            // _protocolState is still AwaitingSeed here, so the Account setter's gate does not fire
+            ns.Account = new MockAccount();
+            Assert.Equal(NetState.InitialRecvBufferSize, ns._socket.RecvBuffer.PhysicalSize);
+
+            ns._protocolState = NetState.ProtocolState.GameServer_LoggedIn;
+
+            var declared = NetState.InitialRecvBufferSize; // as much as the initial buffer can ever hold
+            client.Send(new byte[] { TestPacketId, (byte)(declared >> 8), (byte)declared });
+            SliceUntil(() => ns._socket.RecvBuffer.ReadableBytes == 3);
+
+            Assert.Equal(NetState.ProtocolState.GameServer_LoggedIn, ns._protocolState);
+            Assert.True(ns.Running);
+
+            // The deferred promotion applies at this next completion; the header is then delivered
+            // whole to the 0xB1 no-op handler
+            client.Send(new byte[declared - 3]);
+            SliceUntil(
+                () => ns._socket.RecvBuffer.ReadableBytes == 0 &&
+                      ns._socket.RecvBuffer.PhysicalSize == NetState.RecvBufferSize
+            );
+
+            Assert.True(ns.Running);
+            Assert.Equal(NetState.ProtocolState.GameServer_LoggedIn, ns._protocolState);
+        }
+        finally
+        {
+            ns.Dispose();
+            client.Close();
+        }
+    }
+
+    [SkippableFact]
+    public void HandleReceive_AfterABurstFillsTheInitialBuffer_KeepsReceiving()
+    {
+        Skip.If(NetState.InitialRecvBufferSize == 0);
+        RegisterNoOpPing();
+        var ns = PacketTestUtilities.CreateTestNetState(out var client);
+        try
+        {
+            ns._protocolState = NetState.ProtocolState.GameServer_LoggedIn;
+
+            // One segment of pings fills the 4 KiB buffer (capacity is PhysicalSize - 1, odd, so the
+            // last ping straddles two completions); the parser consumes them all
+            var capacity = ns._socket.RecvBuffer.PhysicalSize - 1;
+            var pings = new byte[capacity + 1];
+            for (var i = 0; i < pings.Length; i += 2)
+            {
+                pings[i] = TestPingPacketId;
+                pings[i + 1] = (byte)(i / 2);
+            }
+
+            client.Send(pings);
+            SliceUntil(() => ns._socket.RecvBuffer.ReadableBytes == 0 && ns._receivedData);
+            Assert.True(ns.Running);
+
+            // Without a re-arm this ping never arrives
+            client.Send(new byte[] { TestPingPacketId, 0xEE });
+            SliceUntil(() => _lastPing == 0xEE);
+            Assert.True(ns.Running);
+        }
+        finally
+        {
+            ns.Dispose();
+            client.Close();
+        }
+    }
+
+    [SkippableFact]
+    public void HandleReceive_AccountAttachedMidParse_ThenOversizeHeader_WaitsForThePendingPromotion()
+    {
+        Skip.If(NetState.InitialRecvBufferSize == 0);
+        RegisterAttachAccount();
+        RegisterVariableLength();
+        var ns = PacketTestUtilities.CreateTestNetState(out var client);
+        try
+        {
+            ns._protocolState = NetState.ProtocolState.GameServer_LoggedIn;
+            var declared = ns._socket.RecvBuffer.PhysicalSize;
+
+            // One send, one completion on loopback: the account packet promotes (deferred: a receive is
+            // armed), then the oversize header reaches the guard with that promotion pending. If the OS
+            // ever splits this into two completions instead, the first assertion block still holds — the
+            // header then hits the guard after the promotion already applied and simply waits on the
+            // 64 KiB buffer, so the test cannot flake, it just exercises the weaker path on that run.
+            client.Send(new byte[] { AttachAccountPacketId, 0x00, 0x00, TestPacketId, (byte)(declared >> 8), (byte)declared });
+            SliceUntil(() => ns.Account != null);
+
+            Assert.True(ns.Running);
+            Assert.Equal(NetState.ProtocolState.GameServer_LoggedIn, ns._protocolState);
+            Assert.Equal(3, ns._socket.RecvBuffer.ReadableBytes); // the header waits, not rejected
+
+            // The next completion applies the promotion and the whole packet is delivered
+            client.Send(new byte[declared - 3]);
+            SliceUntil(
+                () => ns._socket.RecvBuffer.ReadableBytes == 0 &&
+                      ns._socket.RecvBuffer.PhysicalSize == NetState.RecvBufferSize
+            );
+
+            Assert.True(ns.Running);
+        }
+        finally
+        {
+            ns.Dispose();
+            client.Close();
+        }
+    }
+}