BungeeNetworkKeyGrantListener

Hands this proxy's network key to each backend as players connect to it.

Same push model as the Velocity side, and for the same reason: a backend's only route to the proxy is a clientbound plugin message, which proxies drop for channels the player's client has not registered. Pushing writes straight to the backend connection, which exists in every topology including proxy and backends on separate machines.

Bungee has no shared secret to sign the grant with — ip_forward is a plain boolean — so this rests on the assumption Bungee networks already make: that backends are reachable only by their proxy. It adds no trust that ip_forward does not already require.