Implement HTTP/2 CONNECT-IP fallback over TLS #981

Parent: #970

Deliverable

An HTTP/2 listener on TCP/443 that carries CONNECT-IP packets in capsules and uses the same service authority and gVPC packet path as HTTP/3.

Dependencies

#980

Work

• Implement Extended CONNECT negotiation and capsule transport over HTTP/2 with TLS using the selected stack.
• Reuse admission, prefix grants, policy and per-connector ownership from the HTTP/3 service; fallback must not create a second concurrent forwarding owner.
• Implement bounded incremental capsule parsing, stream backpressure and independent cancellation, including capsules split across reads and multiple capsules per read.
• Apply the agreed reconnect and address-retention behavior when a new HTTP/2 tunnel replaces a QUIC tunnel. Automatic product-client transport selection remains out of scope.

Acceptance criteria

• With UDP/443 blocked, an independent client exchanges bidirectional 1280-byte IPv6 packets with real gVPC workloads over TCP/443.
• Packet or negotiated-protocol evidence confirms HTTP/2 over TLS/TCP with no QUIC dependency.
• The same authorization, spoofing, tenant-isolation and expiry cases pass on both transports.
• Truncated, malformed and oversized capsule inputs are bounded; slow readers and cancellation cannot cause unbounded buffering or disrupt another connector.
• A controlled QUIC-to-HTTP/2 reconnect follows the documented continuity contract and never permits dual ownership.

Scope follows #970: CONNECT-IP with HTTP/2 fallback; no public API development, plugin/portal integration, product-client development or production rollout.