feat!: universal redesign — drop Minecraft stack, single-crate architecture

- remove Java plugins (velocity/paper), dashboard, all MC-specific code
  (handshake, death_code, varint, hostname-HMAC); available in history pre-v0.2
- merge crates/* into one package with src/bin/{rampart,rampart-manager,rampart-cli}
- ProtocolHandler trait + registry (no implementations yet), universal PoW kept
- XDP: universal L3/L4 filter (xdp/core/) + pluggable hook API (xdp/hooks/),
  fix IPv6 saddr bug; clang build verified
- docs: bilingual knowledge base (docs/kb/: attacks x4, defense-levels,
  practice x3), rewrite README/architecture for universal concept
- TODO.md v4.0: <=300-line module limit, competitor benchmark section (ref/)
- deploy/CI/docs cleanup: no MC references, new binary names

cargo build/clippy(-D warnings)/test green (55 tests)

tests/protocol_registry.rs

@@ -0,0 +1,38 @@
+use std::future::Future;
+use std::pin::Pin;
+
+use rampart::protocol::{ProtocolHandler, ProtocolRegistry, Upstream};
+use tokio::net::TcpStream;
+
+struct NoopHandler;
+
+impl ProtocolHandler for NoopHandler {
+    fn name(&self) -> &'static str {
+        "noop"
+    }
+
+    fn handshake<'a>(
+        &'a self,
+        _stream: &'a mut TcpStream,
+    ) -> Pin<Box<dyn Future<Output = anyhow::Result<Upstream>> + Send + 'a>> {
+        Box::pin(async { Ok(Upstream::new("127.0.0.1:9000")) })
+    }
+}
+
+#[tokio::test]
+async fn empty_registry_reports_missing_protocols() {
+    let registry = ProtocolRegistry::new();
+    assert!(registry.is_empty());
+    let err = registry.primary().err().expect("empty registry must fail fast");
+    assert!(err.to_string().contains("no protocol plugins compiled"));
+}
+
+#[tokio::test]
+async fn registered_handler_resolves_by_name() {
+    let mut registry = ProtocolRegistry::new();
+    registry.register(Box::new(NoopHandler));
+
+    assert_eq!(registry.names(), vec!["noop"]);
+    let handler = registry.primary().expect("registered handler must resolve");
+    assert_eq!(handler.name(), "noop");
+}