rfc1928: the keep-or-cut sweep + the honest refusal vocabulary (review-002 N-1, N-4)

- N-1 cut: auth_method_enums! (macro + generated StandardAuthentication/
  StandardAuthenticationStarted/allow_no_auth), skip_auth_this_is_not_
  rfc_compliant, CheckResult's Option/Result impls (bool stays) — the
  producer-replaced machinery; ADR-013's no-speculative-surface posture
- N-1 keep-notes made current: ConnectError (hand-port companion; the
  fired trigger + keep disposition recorded in stream.rs),
  transfer/wait_on_tcp (differential-suite-consumed), Bug (upstream-
  verbatim, display intact)
- N-4: new SocksServerError::Refused(&'static str) — the honest log
  vocabulary for the five in-stream policy refusal sites (the BIND
  command gate + dial/egress/bind-factory/bind-accept seams) and the
  harness's minimal producer; wire bytes untouched (Bug keeps its
  display; AuthenticationRejected stays the typestate's auth-reject)
- Provenance extended, not replaced (convention 17): server.rs module
  doc's owned-changes paragraph + rfc1928.md's owned-code post-fork
  changes list + last_updated
- Differential :103 comment reworded to the RFC's ordering rationale;
  AuthMethod doc updated for the macro cut
- Tests: refusal-site session-error asserts moved to Refused, the
  mapping-table loop grew the variant, a display/shape test pins it

Verified: cargo test (356 green incl. --all-features), clippy/fmt/doc
clean, both wasm checks clean.

tests/harness.rs

@@ -384,7 +384,7 @@ where
                 .reply_error(&err.to_reply_error())
                 .await
                 .map_err(SocksError::ServerError)?;
-            return Err(SocksError::ServerError(SocksServerError::Bug(
+            return Err(SocksError::ServerError(SocksServerError::Refused(
                 "dial refused in-stream",
             )));
         }

tests/rfc1928-differential.rs

@@ -100,9 +100,9 @@ async fn negotiation_server_picks_its_own_first_match() {
 
 /// The same contract under `accept_password_auth`: a client offering
 /// none-then-password is answered with the *server's* preferred
-/// method (0x02, listed first upstream per the `StandardAuthentication
-/// ::allow_no_auth` ordering note — `src/server.rs:455-469` upstream
-/// / in-tree `server.rs` "more secure or preferred methods first").
+/// method (0x02 — `negotiate_auth` walks `server_methods` in server
+/// order; RFC 1928 §3 lets the server pick by its own preference, so
+/// the method list is ordered more-secure/preferred first).
 #[tokio::test]
 async fn negotiation_password_server_prefers_password_over_no_auth() {
     let (mut client, server) = tokio::io::duplex(64);