Resolve all architecture open questions, add 13 ADRs, update specs

Resolved all 11 open questions based on project guidance:

Transport:
- OQ-01/OQ-07: ACME/Let's Encrypt with domain + IP paths (ADR-008)
- OQ-02: Default to n0 relay, --iroh-relay override (ADR-009)
- OQ-05: Transport chaining supported natively (ADR-010)

Client:
- OQ-06: Programmatic-first API, no ~/.ssh/config (ADR-011)

Server:
- OQ-04: Ed25519 + OpenSSH cert-authority, no password auth (ADR-012)
- OQ-08: fail2ban-friendly logging + built-in rate limiting (ADR-013)

TUN:
- OQ-03/OQ-09: Deferred entirely, recommend tun2proxy (ADR-014)
- tun-shim.md marked deprecated

NAPI:
- OQ-10: Expose both connect() and serve() (ADR-016)
- OQ-11: Use napi-rs for FFI bridge (ADR-015)

Additional ADRs created during review:
- ADR-006: No logging of tunnel destinations (was phantom reference)
- ADR-017: Stealth mode protocol multiplexing
- ADR-018: Control channel for pubsub over SSH

Fixed: ADR-002 status → Superseded, ADR-007 title typo,
WRAUTH_SERVER typo, ADR-005 stale wraith-tun refs,
undefined ACL feature removed from server.md,
--proxy semantic difference documented.

docs/architecture/README.md

@@ -7,7 +7,7 @@ last_updated: 2026-06-01
 
 ## Current State
 
-Pre-implementation. Feasibility assessment complete (see research/ssh-tunnel-vpn-alternative-feasibility.md). Architecture specification in progress.
+Pre-implementation. Feasibility assessment complete. Architecture specification drafted — all open questions resolved, pending review.
 
 ## Architecture Documents
 
@@ -17,7 +17,7 @@ Pre-implementation. Feasibility assessment complete (see research/ssh-tunnel-vpn
 | [transport.md](transport.md) | draft | Transport abstraction: TCP, TLS, iroh |
 | [client.md](client.md) | draft | Client connection, SOCKS5, port forwarding |
 | [server.md](server.md) | draft | Server acceptance, channel handling, proxy |
-| [tun-shim.md](tun-shim.md) | draft | Privileged TUN interface wrapper (separate process) |
+| [tun-shim.md](tun-shim.md) | deprecated | TUN interface wrapper — **deferred**, use tun2proxy |
 | [napi-and-pubsub.md](napi-and-pubsub.md) | draft | NAPI wrapper and pubsub event target adapter |
 
 ## ADR Table
@@ -25,14 +25,27 @@ Pre-implementation. Feasibility assessment complete (see research/ssh-tunnel-vpn
 | ADR | Title | Status |
 |-----|-------|--------|
 | [001](decisions/001-pluggable-transport.md) | Pluggable transport via `AsyncRead+AsyncWrite` trait | Accepted |
-| [002](decisions/002-tun-separate-process.md) | TUN shim as separate process | Accepted |
-| [003](decisions/002-iroh-stream-join.md) | iroh stream via `tokio::io::join` | Accepted |
+| [002](decisions/002-tun-separate-process.md) | TUN shim as separate process | Superseded by ADR-014 |
+| [003](decisions/003-iroh-stream-join.md) | iroh stream via `tokio::io::join` | Accepted |
 | [004](decisions/004-ssh-over-transport.md) | SSH runs over transport, not alongside | Accepted |
 | [005](decisions/005-socks5-before-tun.md) | SOCKS5 as primary interface, TUN as add-on | Accepted |
+| [006](decisions/006-no-logging-of-tunnel-destinations.md) | No logging of tunnel destinations | Accepted |
+| [007](decisions/007-napi-single-stream.md) | NAPI exposes single duplex stream | Accepted |
+| [008](decisions/008-acme-lets-encrypt.md) | ACME/Let's Encrypt certificate provisioning | Accepted |
+| [009](decisions/009-default-iroh-relay.md) | Default iroh relay with override | Accepted |
+| [010](decisions/010-transport-chaining-cli.md) | Transport chaining in CLI | Accepted |
+| [011](decisions/011-no-ssh-config-programmatic-api.md) | Programmatic-first API, no file-based config | Accepted |
+| [012](decisions/012-auth-ed25519-and-cert-authority.md) | Ed25519 keys + OpenSSH cert-authority, no password auth | Accepted |
+| [013](decisions/013-fail2ban-friendly-logging.md) | Fail2ban-friendly logging + built-in rate limiting | Accepted |
+| [014](decisions/014-defer-tun-recommend-socks5-proxy.md) | Defer TUN, recommend local SOCKS5 + tun2proxy | Accepted |
+| [015](decisions/015-napi-rs-for-ffi-bridge.md) | napi-rs for FFI bridge | Accepted |
+| [016](decisions/016-napi-expose-connect-and-serve.md) | NAPI exposes both connect() and serve() | Accepted |
+| [017](decisions/017-stealth-mode-protocol-multiplexing.md) | Stealth mode — protocol multiplexing on port 443 | Accepted |
+| [018](decisions/018-control-channel-for-pubsub.md) | Control channel for pubsub over SSH | Accepted |
 
 ## Open Questions
 
-See [open-questions.md](open-questions.md)
+All open questions have been resolved. See [open-questions.md](open-questions.md) for details on each resolution.
 
 ## Lifecycle Definitions