## Why

The Data Plane is an empty gateway boundary. Phase 3C-G needs a pure-Go QUIC process that
admits only Connection Server authority, adapts one Apollo/GameStream provider profile, and
relays encoded bytes without exposing the provider or decoding media.

## What Changes

- Add bounded QUIC/TLS streams and DATAGRAM framing with authenticated admission.
- Add a native-Go Apollo profile, deterministic fixtures, a bounded fake provider, lifecycle
  cleanup, input release, capability intersection, pacing, telemetry, and packaging.

## Provenance

Provider behavior is independently implemented from the exact Apollo pin
`adc5c5a0bd80831ce495434bb16aee2cd4175fb8` and the Planning Hub's recorded public
Moonlight/common-C protocol evidence. Only the used source paths are recorded; no source
tree or proprietary capture is copied.

## Non-goals

No cgo, native sidecar, decoder/encoder/transcoder/render path, direct provider route,
database credential, provider plugin framework, or live Apollo qualification.