Per-tunnel server session for Connect-UDP-Bind (draft-ietf-masque-connect-udp-listen-11). Sibling of masque_server_session / masque_h2_server_session; one module serves both h2 and h3 by dispatching on a transport field, the same shape used by masque_ip_server_session.

Responsibilities:

• Run the handler's init/2 and splice the resulting {response_headers, _} action into the 2xx response so the proxy emits Connect-UDP-Bind: ?1 and Proxy-Public-Address.
• Own the per-session compression tables (own + peer, via masque_compression_table).
• Drain capsules off the request stream and dispatch COMPRESSION_ASSIGN / ACK / CLOSE to the table; pass any other capsule to the handler's handle_capsule/3.
• Decode incoming HTTP datagrams: extract context-id, look up the compression-table entry, decode the inner Bound UDP Proxying Payload via masque_udp_bind_payload, and call masque_udp_bind_proxy_handler:handle_bind_packet/3.
• Apply handler actions ({send_bind_packet, Peer, Bytes}, {compression_assign, _}, {compression_ack, _}, {compression_close, _}, plus the legacy send_capsule / close_session).

Deliberately minimal in this first PR:

• Wait-for-ACK on send is implemented via the table's state field; an outbound mapping is pending_ack until COMPRESSION_ACK arrives. The session emits compressed payloads only against installed entries; otherwise it falls through to the uncompressed channel if open, or drops the packet.
• The max_pending_compression_responses bound and the post-close prohibition are deferred to a follow-up PR; the hooks are in place but the policy is permissive.