Server-side flow manager that handles per-user packet encryption, decoy traffic, and socket I/O.
Per-user crypto state is in the global SharedMap (accessed via ServerCryptoTool).
Send and receive crypto are split into independent instances so their locks never contend.
Per-user source addresses and decoy providers are local to each flow manager instance.
When built with multiple sockets (SO_REUSEPORT on Linux), each socket is polled by its own
drain task in the listener; the kernel distributes incoming datagrams across all sockets.