gRPC for Dart 5.0

Apply the Dart 3.13 prompt first. These rules cover the gRPC-Dart 5.0 release line: native listeners and clients, browser gRPC-Web clients, and custom transports. They were checked against the published 5.0.0 package. That package declares Dart >=3.8.0 <4.0.0, protobuf: ^5.1.0, and http2: ^2.3.1; do not import options or guarantees from gRPC Core or newer Dart packages.

Listener and transport boundaries

• Register only intended services through Server.create and pass an explicit address, port, security, and http2ServerSettings to Server.serve; omitting address binds all IPv4 interfaces and a null security context creates a plaintext listener. Retain the default shared: false unless shared binding is intentional.
• For a local-only service, bind an explicit loopback address or a Unix-domain socket inside a permission-restricted directory and test that non-local peers cannot connect.
• Do not rely on ServerLocalCredentials for locality in 5.0.0: Server.serve uses its null securityContext to create a plaintext socket and does not call ServerCredentials.validateClient.
• Put an externally reachable listener behind a gRPC-aware ingress with authentication, connection and stream admission limits, and an explicit route allowlist; prevent direct access around that ingress.
• Treat ConnectionServer and ClientTransportConnectorChannel as raw trust-boundary APIs: authenticate and encrypt the supplied transport and derive clientCertificate, remoteAddress, target, and authority only from verified transport state. Setting secure