feat: extend TCP keepalive support to all TCP-based listeners and dialers

Add configurable TCP keepalive (keepalive, keepalive.idle,
keepalive.interval, keepalive.count) to all TCP-based transport types:
tls, mtls, mtcp, ws/wss, mws/mwss, http2, ssh, sshd listeners and
tls, mtls, mtcp, ws/wss, mws/mwss, ssh, sshd dialers.

For types that already use "keepalive" for an app-level protocol
(grpc listener/dialer, ws/mws dialers, ssh/sshd dialers), the TCP
keepalive parameters are exposed under the tcp.keepalive.* prefix to
avoid ambiguity.

Also extract shared helpers into internal/net/keepalive.go:
- WrapKeepaliveListener: applies KeepAliveConfig on every accepted TCPConn
- ApplyKeepalive: applies KeepAliveConfig to a single TCPConn

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/net/keepalive.go

@@ -0,0 +1,32 @@
+package net
+
+import "net"
+
+// WrapKeepaliveListener wraps ln so that TCP keepalive config is applied to
+// every accepted *net.TCPConn before it enters the middleware wrapper chain.
+func WrapKeepaliveListener(ln net.Listener, cfg net.KeepAliveConfig) net.Listener {
+	return &keepaliveListener{Listener: ln, cfg: cfg}
+}
+
+// ApplyKeepalive applies cfg to conn if it is a *net.TCPConn.
+func ApplyKeepalive(conn net.Conn, cfg net.KeepAliveConfig) {
+	if tc, ok := conn.(*net.TCPConn); ok {
+		tc.SetKeepAliveConfig(cfg)
+	}
+}
+
+type keepaliveListener struct {
+	net.Listener
+	cfg net.KeepAliveConfig
+}
+
+func (l *keepaliveListener) Accept() (net.Conn, error) {
+	conn, err := l.Listener.Accept()
+	if err != nil {
+		return nil, err
+	}
+	if tc, ok := conn.(*net.TCPConn); ok {
+		tc.SetKeepAliveConfig(l.cfg)
+	}
+	return conn, nil
+}