docs(admission): add package and symbol doc comments

Add package-level documentation and Go doc comments for all exported
types, functions, and methods across the admission package, its plugin
sub-packages, and connection/listener wrappers.

admission/plugin/grpc.go

@@ -1,3 +1,9 @@
+// Package admission implements gRPC-based admission plugins.
+// An admission plugin delegates the admit/deny decision to an external
+// service via gRPC. This allows admission logic to be implemented in
+// a separate process using any language supported by protobuf.
+//
+// The gRPC service definition is in plugin/admission/proto.
 package admission
 
 import (
@@ -11,13 +17,27 @@ import (
 	"google.golang.org/grpc"
 )
 
+// grpcPlugin is an admission controller that delegates to an external
+// gRPC admission service.
+//
+// If the gRPC connection cannot be established at construction time,
+// the client field remains nil and Admit returns true (fail-open),
+// allowing all traffic through rather than blocking everything.
 type grpcPlugin struct {
 	conn   grpc.ClientConnInterface
 	client proto.AdmissionClient
 	log    logger.Logger
 }
 
-// NewGRPCPlugin creates an Admission plugin based on gRPC.
+// NewGRPCPlugin creates an admission controller that communicates with
+// an external gRPC admission service at the given address.
+//
+// The name is used only for log identification. The addr should be a
+// gRPC target string (e.g. "127.0.0.1:9000"). Additional plugin options
+// (TLS, token, retry) can be passed via opts.
+//
+// If the connection fails, the plugin logs the error and operates in
+// fail-open mode: all admission requests return true.
 func NewGRPCPlugin(name string, addr string, opts ...plugin.Option) admission.Admission {
 	var options plugin.Options
 	for _, opt := range opts {
@@ -43,6 +63,13 @@ func NewGRPCPlugin(name string, addr string, opts ...plugin.Option) admission.Ad
 	return p
 }
 
+// Admit sends an admission request to the external gRPC service.
+// It passes the network, address, and service name from the client
+// connection.
+//
+// If the gRPC client is nil (connection failed at startup), it returns
+// true (fail-open). If the RPC returns an error, it logs the error and
+// returns false.
 func (p *grpcPlugin) Admit(ctx context.Context, network, addr string, opts ...admission.Option) bool {
 	if p.client == nil {
 		return true
@@ -66,6 +93,7 @@ func (p *grpcPlugin) Admit(ctx context.Context, network, addr string, opts ...ad
 	return r.Ok
 }
 
+// Close closes the underlying gRPC connection if it implements io.Closer.
 func (p *grpcPlugin) Close() error {
 	if closer, ok := p.conn.(io.Closer); ok {
 		return closer.Close()