C++20 port 15/15: remove the stream ciphers (#3079)

* Remove the stream ciphers

The unauthenticated stream ciphers (aes-*-cfb, aes-*-ctr, camellia-*-cfb,
chacha20, chacha20-ietf, salsa20) are gone from every build, together
with the SS_ENABLE_LEGACY option, the C++ stream codecs, their C test
oracle and the stream-only tests and configurations. A configuration
naming one of them, or RC4/table, now fails at startup with a message
pointing to an AEAD method, and test_cli checks that.

Shell completions list only the supported methods (and now include the
2022 ones), and the docs and the compatibility contract say the stream
ciphers were removed.

* Drop the Mbed TLS CFB requirement and stale stream-cipher examples

CFB was only needed by the removed stream ciphers, so a system Mbed TLS
built without it no longer fails to configure. The public header example
now uses aes-256-gcm.

docs/cpp-core.md

@@ -83,8 +83,8 @@ engines do not link it.
 
 ## Crypto (`src/crypto/`)
 
-`aead.hpp` (SIP004/SIP007 AEAD), `aead2022.hpp` (SIP022) and `stream.hpp`
-(legacy stream ciphers) provide value-type codecs: the cipher state is held
+`aead.hpp` (SIP004/SIP007 AEAD) and `aead2022.hpp` (SIP022) provide
+value-type codecs (the unauthenticated stream ciphers were removed): the cipher state is held
 inside the codec, TCP decoders reassemble into a fixed buffer sized for one
 chunk and can hand plaintext out in windows of any size, and HKDF-SHA1 runs
 on stack SHA-1 state. `keys.hpp` derives keys and lists the supported
@@ -151,7 +151,7 @@ includes a DNS lookup.
 | aes-256-gcm | 89.1 | 39.2 |
 | chacha20-ietf-poly1305 | 83.1 | 33.0 |
 | 2022-blake3-aes-256-gcm | 84.0 | 33.0 |
-| aes-256-cfb (stream) | 77.1 | 26.5 |
+| aes-256-cfb (stream, since removed) | 77.1 | 26.5 |
 | aes-256-gcm, 1-byte payload | 85.0 | 36.0 |
 
 The C++ programs are at 0 for every row, including the name-resolving

docs/modernization.md

@@ -7,10 +7,15 @@ review: https://github.com/shadowsocks/shadowsocks-libev/pull/3050 (merged).
 ## Compatibility contract
 
 Keep the existing CLI, JSON configuration, ss:// parsing, SIP003 plugins,
-ACL blacklist/whitelist/outbound precedence, public shadowsocks.h API, legacy
-stream ciphers, AEAD and SIP022 TCP/UDP behavior in the compatibility profile.
-Removing regex or legacy ciphers is explicit opt-in, with configuration errors
-for unavailable functionality. Linux redirection/netfilter remains Linux-only.
+ACL blacklist/whitelist/outbound precedence, public shadowsocks.h API, AEAD
+and SIP022 TCP/UDP behavior in the compatibility profile. Removing regex is
+explicit opt-in, with configuration errors for unavailable functionality.
+
+Amended in the C++20 rewrite: the unauthenticated stream ciphers
+(`aes-*-cfb`, `aes-*-ctr`, `camellia-*-cfb`, `chacha20`, `chacha20-ietf`,
+`salsa20`, and before them RC4 and `table`) are removed in every build. A
+configuration naming one fails at startup with a message pointing to an AEAD
+method. Linux redirection/netfilter remains Linux-only.
 
 The sources are moving from C11 to C++20 module by module, with an explicit
 ownership model and no heap allocation after startup. The public
@@ -34,7 +39,8 @@ ownership model and no heap allocation after startup. The public
 - [x] Portability layer for sockets/errors, I/O, clocks, randomness and processes.
 - [x] Runtime CI: Linux glibc/musl, macOS, FreeBSD, Windows MinGW.
 - [x] Document MSVC/event-loop compatibility assessment as a later milestone.
-- [x] Minimal profile: no regex/plugins/manager/legacy stream ciphers.
+- [x] Minimal profile: no regex/plugins/manager.
+- [x] Stream ciphers removed from all builds (C++20 rewrite).
 - [x] Crypto-only Mbed TLS configuration and evidence-backed provider assessment.
 - [x] Complete sanitizers/static analysis, compatibility and stress validation,
       release archive offline build, installed consumer, before/after report.
@@ -162,8 +168,7 @@ or inventing replacement crypto implementations is outside this modernization.
 Retain libsodium plus Mbed TLS crypto primitives. The bundled Mbed TLS config
 omits TLS, X.509, certificate parsing and handshake machinery; it retains only
 cipher/hash primitives needed by protocol compatibility. Libsodium alone cannot
-replace AES-128-GCM, software AES fallback, MD5/SHA1 compatibility derivation and
-legacy stream modes. PCRE2 is absent in the minimal profile. This removes three
+replace AES-128-GCM, software AES fallback and MD5/SHA1 compatibility derivation. PCRE2 is absent in the minimal profile. This removes three
 submodule dependencies and reduces what is built without replacing audited
 cryptographic algorithms with project-specific implementations.
 

docs/performance.md

@@ -18,7 +18,7 @@ connection as ss-server / ss-local.
 | aes-256-gcm | 39.0 / 39.0 | 0 / 0 |
 | chacha20-ietf-poly1305 | 33.1 / 33.0 | 0 / 0 |
 | 2022-blake3-aes-256-gcm | 34.0 / 32.9 | 0 / 0 |
-| aes-256-cfb | 27.1 / 26.4 | 0 / 0 |
+| aes-256-cfb (stream, since removed) | 27.1 / 26.4 | 0 / 0 |
 
 With a host-name target (`localhost`, resolved by ss-server) the C++ programs
 are still at 0, because c-ares allocates from its fixed heap. The C ss-server