[TLS] Wire TLS encryption into the server Netty pipeline

### Search before asking

- [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.

### Description

Part of #3786 ([FIP-29: (m)TLS Support](https://cwiki.apache.org/confluence/spaces/FLUSS/pages/406620533/FIP-29+m+TLS+Support)).

**Wave 1** — depends on: SSL config & context foundations (#3796).

Wires `SslHandler` into the server-side pipeline, enabling real encrypted connections for the first time — encryption only, no client-certificate requirement yet (`ClientAuth.NONE` on every TLS listener).

- `ServerChannelInitializer` — `pipeline.addFirst("ssl", ...)` for listeners in `security.ssl.enabled.listeners`, before the frame decoder.
- `NettyServer` / `FlussProtocolPlugin` — thread `Configuration` + listener name into `createChannelHandler`; minimal fail-fast validation (a TLS-enabled listener requires a keystore).
- `TlsFileRegionHandler` — copies file-backed log-fetch records into JVM memory before encryption, since `sendfile` and `SslHandler` are mutually exclusive.
- `TlsClusterITCase` — end-to-end cluster test with an encrypted listener.

**Depends on:** SSL config & context foundations (#3796).
**Depended on by:** client pipeline integration (#3797), internal listener migration (#3798), certificate hot-reload (#3799), mTLS authentication (#3793), Flink connector test (#3794), Spark connector test (#3800).

_Estimated diff size: ~415 lines._

_(Note: this replaces this ticket's original broader "server + client" scope, now split further into dedicated tickets.)_

### Willingness to contribute

- [x] I'm willing to submit a PR!

Start with the SSL config and context foundations in #3796, then inspect ServerChannelInitializer, NettyServer, FlussProtocolPlugin, and TlsFileRegionHandler. Run TlsClusterITCase to verify an encrypted listener works end to end. Done means TLS listeners use the server pipeline, configuration and listener names reach channel creation, missing keystores fail fast, and file-backed log-fetch records work with encryption.

Written by the indexing model from the issue text.