[RIP-2] Add proxy admin online client query endpoint

[pilichoumao]

Summary

This draft PR contains the RocketMQ implementation for RIP-2 Proxy Admin M1
online-client query through the generated public
apache.rocketmq.v2.ProxyAdminService:

• ListClients
• DescribeClient
• ListClientsByGroup
• ListClientsByTopic

The public service runs on the independent Proxy admin gRPC listener and reuses
the lifecycle-fed read model, ACL, metrics, tracing, bounded query executor, and
error semantics in this branch.

Review Checkpoints

• RocketMQ branch head: bde34c88ba575177b28e2854a8e7fa20ee628a82
• Formal API proposal: c372905ce927cf8957333e7ac07877f295fd7ec9
• Reproducible benchmark source: 8c3098d51615189677118200955aeb6bdcbf90c0
• API draft PR: [RIP-2] Add proxy admin online client query API rocketmq-apis#112
• RIP-2 issue: [RIP-2] Proxy Admin gRPC Interface Surface (M1: Online Client Query Module) #10599
• Reviewer runbook: docs/en/rip2-proxy-admin-m1-review-runbook.md
• Submission package: docs/en/rip2-proxy-admin-m1-submission-package.md

Contract And Isolation

• M1 accepts omitted scope and PROXY_SCOPE_LOCAL_PROXY.
• PROXY_SCOPE_ALL_PROXIES and PROXY_SCOPE_PROXY_ID remain gated until the
  community defines discovery, authorization, timeout, and pagination ownership.
• Public admin traffic is isolated from MessagingService by service, port,
  server executor, query executor, and authentication pipeline.
• ACL resource is Admin:proxy.admin.client; list operations require LIST,
  describe requires GET.
• Per-stream generations and transport identity prevent stale reconnect events
  from mutating a newer client session.
• Queued calls re-check cancellation and deadlines before conversion, ACL, or
  service work.

Verification

JDK 17 focused verification:

Tests run: 57, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
Finished at: 2026-07-12T02:37:36+08:00

Broad proxy admin verification:

Tests run: 779, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
Finished at: 2026-07-12T02:35:18+08:00

Package smoke:

BUILD SUCCESS
Finished at: 2026-07-12T02:36:24+08:00

Live release-distribution smoke:

mvn -Prelease-all -DskipTests -DskipITs package: BUILD SUCCESS
Finished at: 2026-07-12T02:49:18+08:00

Direct grpcurl calls reached all four public RPCs on 8082, verified live
NOT_FOUND and BAD_REQUEST semantics, and proved that ProxyAdminService is
absent from messaging port 8081 while MessagingService and reflection are
absent from admin port 8082. Cleanup closed ports 9876, 8081, and 8082.

Authenticated release-distribution smoke (dev/run_rip2_authenticated_smoke.sh)
also exited 0: valid super-user signing returned OK, unsigned and invalid
signatures returned UNAUTHORIZED, and LIST-only / GET-only users enforced the
expected action split on Admin:proxy.admin.client. Bounded cleanup closed
ports 9876, 8081, 8082, and 10911.

Core JaCoCo evidence:

• service.admin.client instruction 92.93%, branch 86.62%, line 94.41%
• grpc.v2.admin instruction 92.81%, branch 85.79%, line 94.73%

Reproducible 1M-client, fixed-4-GiB deep full-range pagination evidence:

• read model P99 0.011 ms, max RSS 1223.7 MiB
• generated public gRPC P99 0.843 ms, max RSS 2792.3 MiB
• both runs: zero swaps, no OOM, verified 11-file SHA-256 manifests

Submission guard:

python3 dev/rip2_submission_guard.py --check-remote --check-apis-remote --check-github
RIP-2 submission guard passed.

External Gates

• The implementation still uses local contest artifact
  org.apache.rocketmq:rocketmq-proto:2.2.0-rip2-SNAPSHOT; community API
  acceptance and an official artifact are required before merge.
• Dashboard CLIENT-01 joint E2E needs the external RIP-1 Dashboard environment.
• Both fork PRs have GitHub Actions runs with conclusion action_required and
  no check runs. Apache maintainer approval is required before jobs can start;
  the strict --require-github-checks gate remains red until they run and pass.

JDK 17 may print JaCoCo 0.8.5 instrumentation stack traces. They are environment
noise only when Surefire reports zero failures/errors and Maven exits 0.