Chunked transfer-encoding — parser support + tests

[shinagawa-web]

Part of the test strategy (#56). #28 deliberately excludes chunked encoding ("separate task — add it to the parser AND test it together"), and it sits untracked in the v0.5.0 "Stable HTTP/1.1 capture" line (#19) with no issue. This issue is that task: implement Transfer-Encoding: chunked in the parser and test it in the same change.

Without this, any server that streams a response without a Content-Length (the common case for dynamic responses behind nginx/Node) is mis-framed — the parser can't tell where the message body ends.

Scope

• Parser support — recognise Transfer-Encoding: chunked, parse the chunk-size lines, accumulate chunks until the terminating 0\r\n\r\n, ignore chunk extensions, handle a trailing header section.
• Table-driven tests (per Test strategy — layering, what runs where, conventions #56 conventions):
  • single chunk, multiple chunks, empty body (immediate 0\r\n\r\n)
  • chunk boundary split across syscalls (chunk-size line straddling two reads; body straddling two reads)
  • chunk extensions present (1a;ext=val\r\n) — parsed and ignored
  • trailer headers after the last chunk
  • malformed: non-hex chunk size, missing terminating chunk before close, oversized chunk vs maxBufBytes
  • interaction with the 256-byte payload sample cap (Lift the 256-byte BPF payload sample cap #36)
• e2e — feed into e2e test suite — real BPF + assertion-driven scenarios #29's "chunked response (once parser supports it)" scenario (nginx / Node default).
• Local manual test — start nginx as a reverse proxy to a backend that omits Content-Length, run sudo ./tinytap, fire curl, and confirm tinytap captures Transfer-Encoding: chunked responses with correct framing. Paste the captured output in the PR description.

Out of scope

• HTTP/2 framing (v2.x)
• Compression (Content-Encoding: gzip) — separate concern from transfer framing

Done when

• The parser correctly frames a chunked response with no Content-Length
• Chunk-boundary-split-across-syscalls is covered by table-driven tests
• Local nginx test passes and the captured output is pasted in the PR description
• e2e test suite — real BPF + assertion-driven scenarios #29 can assert a real chunked response from nginx/Node