chore(protocols): narrow the SessionDiag blanket to its one unread field

The last item-level bare allow of backlog#1823 step 10. `SessionDiag` itself is live — `sftp/server.rs` constructs one per accepted connection and `wedge_watchdog` reads `session_id`, `peer` and `last_activity_ms` off it — so the struct-level blanket was covering exactly one field: `accepted_at`, which is written at accept time and never read back. The allow moves onto that field with a reason.

The three remaining `#![allow(dead_code)]` in this crate (`sftp/test_support.rs`, `common/dummy_storage.rs`) are module-root blankets in test-support files, which belong to steps 1-5 rather than step 10.

Refs backlog#1823

crates/protocols/src/sftp/lifecycle.rs

@@ -84,11 +84,11 @@ const TCP_STATE_RADIX: u32 = 16;
 /// and the SftpDriver, registered weakly into the SessionRegistry so an
 /// outside observer can enumerate live sessions without holding their
 /// lifetime.
-#[allow(dead_code)]
 pub struct SessionDiag {
     pub session_id: u64,
     pub local: SocketAddr,
     pub peer: SocketAddr,
+    #[allow(dead_code, reason = "written at accept time but never read back (backlog#1823)")]
     pub accepted_at: Instant,
     pub last_activity_ms: AtomicU64,
 }