100%/B: S9F3/F5/F11 emission + Router fallback

Closes the S9 stream.  Every documented protocol-error condition is now
auto-emitted by Connection (with the assist of one Router predicate),
without involving the application.

Router (include/secsgem/gem/router.hpp)
  Adds two predicates: has_handler(stream, function) and
  has_handler_for_stream(stream).  Lets the wrapping message handler
  decide whether an unhandled message is "unknown stream" (S9F3) or
  "unknown function in a known stream" (S9F5).

Connection (include/secsgem/hsms/{connection.hpp, connection.cpp})
  - emit_s9() goes public so the message_handler can call it.
  - New current_header() accessor returns the HSMS header of the
    primary currently being dispatched.  Non-null only inside the
    on_message_ call; cleared on the way out.
  - handle_data sets current_header_ before invoking on_message_.
  - on_length on oversized frame: synthesizes a 10-byte MHEAD whose
    first 4 bytes are the offending length prefix, emits S9F11, and
    sets close_after_flush so the S9F11 goes out before the socket
    closes.

Server (apps/secs_server.cpp)
  The conn->set_message_handler lambda now wraps router.dispatch.  For
  any inbound primary without a registered handler, it captures the
  MHEAD via current_header() and emits either S9F3 (stream unknown) or
  S9F5 (function unknown).  The wrapper still returns the Router's
  reply (SxF0 for primaries with W) so transactional semantics are
  preserved.

COMPLIANCE.md
  Error Messages row flips from 🟡 to ✅.  S9F3/F5/F11 rows in the
  coverage matrix flip from 🟡 to ✅.  Each row in the matrix now
  states its trigger condition explicitly.  Drops the
  "Finish S9 wiring" bullet from the "what would 100% take" list.

Verified
  - Tests: 78 cases / 454 assertions still pass (no behavioural change
    on the happy path; new emission paths fire only on protocol errors
    that the demo doesn't induce).
  - Build clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/hsms/connection.cpp

@@ -74,7 +74,18 @@ void Connection::on_length(std::error_code ec, std::size_t) {
     return;
   }
   if (len > kMaxFrameLength) {
-    close("frame too large: " + std::to_string(len));
+    // We can't read the actual offending header (the message body is too
+    // big to safely buffer), so synthesize a 10-byte MHEAD whose first 4
+    // bytes are the offending length prefix and the rest are zero.  The
+    // host sees S9F11, the connection then drains the write queue and
+    // closes.
+    std::array<uint8_t, 10> mhead{};
+    mhead[0] = len_buf_[0]; mhead[1] = len_buf_[1];
+    mhead[2] = len_buf_[2]; mhead[3] = len_buf_[3];
+    log("frame too large: " + std::to_string(len) + "; emitting S9F11 and closing");
+    emit_s9(11, mhead);
+    close_after_flush_ = true;
+    close_reason_ = "frame too large";
     return;
   }
 
@@ -180,7 +191,12 @@ void Connection::handle_data(const Frame& frame) {
   log("<- " + h.describe());
   if (!on_message_) return;
 
+  // Expose the originating header to the handler in case it needs to emit
+  // an S9F3 / S9F5 in response.  Cleared on the way out.
+  current_header_ = &h;
   auto reply = on_message_(msg);
+  current_header_ = nullptr;
+
   if (reply) {
     Frame out(Header::data_message(device_id_, reply->stream, reply->function,
                                    reply->reply_expected, h.system_bytes),