Minimal, sync SCRAM-SHA-256 (RFC 5802 / RFC 7677) state machine for server and client roles, with channel-binding-aware GS2 parsing.