Fix CurveServerCertificate setting wrong socket option

[Copilot]

CurveServerCertificate was setting CurveServerKey (the remote server's public key, a client-side option) instead of the server socket's own CurveSecretKey + CurvePublicKey. This left CurveSecretKey as all-zeros on the server, causing CurveServerMechanism to fail decrypting every client HELLO and silently reject all connections.

Changes

• SocketOptions.cs / ThreadSafeSocketOptions.cs: CurveServerCertificate now sets CurveSecretKey + CurvePublicKey (the server's own key pair) instead of CurveServerKey. Requires a certificate with a secret key. Updated docs to clarify server-side intent and point clients to CurveServerKey = serverCert.PublicKey.
• CurveTests.cs: Added CurveServerCertificateTest reproducing the reported pattern.

Before / After

// Before: silently misconfigured — CurveSecretKey stayed all-zeros
server.Options.CurveServer = true;
server.Options.CurveServerCertificate = serverCert; // was setting CurveServerKey — wrong

// After: works as the name implies
server.Options.CurveServer = true;
server.Options.CurveServerCertificate = serverCert; // sets CurveSecretKey + CurvePublicKey

// Clients specify the server's public key via:
client.Options.CurveServerKey = serverCert.PublicKey;
client.Options.CurveCertificate = clientCert;