gRPC for Dart 5.1

Apply the Dart 3.13 prompt first. These rules cover the grpc 5.1 release line: native clients and servers and browser gRPC-Web clients. They were checked against the published 5.1.0 package. That package requires Dart >=3.8.0 <4.0.0, protobuf: ^6.0.0, and http2: ^2.3.1; use generated code compatible with the selected protobuf runtime.

Transport and listener boundaries

• Retain the native ChannelOptions default of ChannelCredentials.secure(). Supply private roots through certificates when needed; leave onBadCertificate unset and never use allowBadCertificates in production. Limit insecure channels to isolated tests or explicitly protected local hops.
• Fix channel destinations, ChannelCredentials.authority, and Proxy settings in trusted configuration. The authority override affects TLS identity and credential audiences. Protect any hop carrying Proxy.username and Proxy.password: CONNECT proxy authentication occurs before backend TLS.
• Set Server.serve(address: ..., security: ...) explicitly. Without TLS credentials the server is plaintext, and an omitted address binds all IPv4 interfaces. Use ServerTlsCredentials or a trusted TLS terminator with a backend that clients cannot reach directly.
• Bind local-only servers to an explicit loopback address or protected Unix socket. Do not rely on ServerLocalCredentials or a validateClient override as the network access-control boundary in 5.1.0.
• For mutual TLS, configure a ServerCredentials.securityContext trusting the intended client CAs and set both requestClientCertificate: true and