fix(pr3): adapt to quic-go v0.59.0 API — drop H3App, capture h3 SETTINGS via http3.Settingser

quic-go v0.59.0 (shipped with Caddy v2.11.2) removed quic.Connection as
a public interface and quic-go/logging as a public package, breaking
H3App's connection-wrapping approach.

Resolution:
- Remove H3App (h3app.go) entirely; Caddy handles h3 natively when h3
  is in the protocols list.
- Rewrite h3conn.go to keep only tryParseH3ControlStream + varint/name
  utilities (tested, useful for future stream-level tapping if the API
  ever re-exposes it).
- FPHandler.ServeHTTP: for h3 requests, type-assert ResponseWriter to
  http3.Settingser (the public interface exposed by quic-go/http3 v0.59),
  read the peer's Settings after ReceivedSettings channel closes, emit
  h3_settings fp record.
- https/entrypoint.sh: include h3 in CADDY_PROTOCOLS (Caddy now owns
  UDP/443); remove DECNET_H3_GLOBAL block.
- Update go.mod/go.sum to caddy v2.11.2 + quic-go v0.59.0.
- Update test_https_compose_h3_app.py to expect h3 in protocols when
  http/3 is selected, and assert decnet_h3 block is absent.
- All Go tests (9) and Python tests (15) remain green.

decnet/templates/https/entrypoint.sh

@@ -29,8 +29,8 @@ if [ ! -f "$CERT" ] || [ ! -f "$KEY" ]; then
         2>/dev/null
 fi
 
-# Parse HTTP_VERSIONS JSON → Caddy protocol tokens (h1 / h2 only).
-# h3 is handled by decnet_h3 Caddy app (H3App owns UDP/443); never goes to Caddy native h3.
+# Parse HTTP_VERSIONS JSON → Caddy protocol tokens.
+# Caddy handles h3 natively; h3 SETTINGS are captured via FPHandler (http3.Settingser).
 CADDY_PROTOCOLS=$(python3 -c "
 import json, os
 versions = json.loads(os.environ.get('HTTP_VERSIONS', '[\"http/1.1\"]'))
@@ -39,15 +39,9 @@ if 'http/1.1' in versions:
     tokens.append('h1')
 if 'http/2' in versions:
     tokens.append('h2')
-print(' '.join(tokens) if tokens else 'h1')
-")
-
-# When http/3 is selected, activate the decnet_h3 Caddy app (global block).
-DECNET_H3_GLOBAL=$(python3 -c "
-import json, os
-versions = json.loads(os.environ.get('HTTP_VERSIONS', '[\"http/1.1\"]'))
 if 'http/3' in versions:
-    print('  decnet_h3')
+    tokens.append('h3')
+print(' '.join(tokens) if tokens else 'h1')
 ")
 
 DECNET_FP_SOCK="${DECNET_FP_SOCK:-/run/decnet/fp.sock}"
@@ -57,7 +51,6 @@ rm -f "$DECNET_FP_SOCK"
 cat > /etc/caddy/Caddyfile <<EOF
 {
   admin off
-${DECNET_H3_GLOBAL}
   servers :443 {
     protocols ${CADDY_PROTOCOLS}
     listener_wrappers {