feat(wasi): expose protobuf RPC request ABI (#2477)

* feat(wasi): expose protobuf RPC request ABI

Add an instance-scoped asynchronous RPC session backed by the shared
operation broker. Reuse the existing dispatcher and management handlers.
WASI hosts can call PeerManageRpc and ConnectorManageRpc with the same
protobuf payloads as easytier-cli.

Export ABI version, submit, take, and free functions. Bind selectors to
the WASM instance handle and keep method errors in RpcResponse. Enable
management RPC explicitly in the Go-host WASM build.

* fix(gateway): serialize UDP client eviction

Serialize UDP client admission across forwarding rules so only one
eviction can claim and wait for a released semaphore permit. Retry
when cleanup concurrently removes the selected client.

Add a multithreaded regression test for the permit handoff while the
evicted client is still referenced.

* fix(gateway): publish UDP client admission atomically

Hold the admission guard through client and response-task publication
so a concurrent eviction cannot leave an orphan task holding the slot
permit.

Open the data-plane flow before entering the critical section and extend
the multithreaded regression test across the publication window.

easytier-proto/proto/api_config.proto

@@ -80,6 +80,7 @@ message GetConfigRequest {
 
 message GetConfigResponse {
   api.manage.NetworkConfig config = 1;
+  string toml_config = 2;
 }
 
 service ConfigRpc {

easytier-proto/proto/common.proto

@@ -102,6 +102,24 @@ message RpcRequest {
   int32 timeout_ms = 3;
 }
 
+// One transport-neutral RPC invocation submitted through a direct ABI.
+//
+// full_method_name uses the protobuf reflection form:
+// "<package>.<service>.<method>" or "<service>.<method>" for an empty package.
+message DirectRpcRequest {
+  string full_method_name = 1;
+  bytes request = 2;
+  optional uint64 timeout_ms = 3;
+}
+
+// One process-level management call delegated by the WASI WebClient to its host.
+message HostManagementRequest {
+  DirectRpcRequest rpc = 1;
+  optional string prepared_config = 2;
+  // Runtime identity paired with prepared_config without rewriting rpc.request.
+  UUID prepared_instance_id = 3;
+}
+
 message RpcResponse {
   bytes response = 1;
   error.Error error = 2;