Resolve all architecture open questions, add 13 ADRs, update specs

Resolved all 11 open questions based on project guidance:

Transport:
- OQ-01/OQ-07: ACME/Let's Encrypt with domain + IP paths (ADR-008)
- OQ-02: Default to n0 relay, --iroh-relay override (ADR-009)
- OQ-05: Transport chaining supported natively (ADR-010)

Client:
- OQ-06: Programmatic-first API, no ~/.ssh/config (ADR-011)

Server:
- OQ-04: Ed25519 + OpenSSH cert-authority, no password auth (ADR-012)
- OQ-08: fail2ban-friendly logging + built-in rate limiting (ADR-013)

TUN:
- OQ-03/OQ-09: Deferred entirely, recommend tun2proxy (ADR-014)
- tun-shim.md marked deprecated

NAPI:
- OQ-10: Expose both connect() and serve() (ADR-016)
- OQ-11: Use napi-rs for FFI bridge (ADR-015)

Additional ADRs created during review:
- ADR-006: No logging of tunnel destinations (was phantom reference)
- ADR-017: Stealth mode protocol multiplexing
- ADR-018: Control channel for pubsub over SSH

Fixed: ADR-002 status → Superseded, ADR-007 title typo,
WRAUTH_SERVER typo, ADR-005 stale wraith-tun refs,
undefined ACL feature removed from server.md,
--proxy semantic difference documented.

docs/architecture/decisions/010-transport-chaining-cli.md

@@ -0,0 +1,33 @@
+# ADR-010: Transport Chaining in CLI
+
+## Status
+Accepted
+
+## Context
+Transport chaining allows combining iroh with an upstream proxy, e.g.:
+
+```bash
+wraith connect --transport iroh --proxy socks5://127.0.0.1:1080
+```
+
+This routes iroh's outbound TCP connections through a SOCKS5 proxy, which could itself be another wraith instance. This is important for:
+- Nested tunnel topologies
+- Environments where iroh needs to go through an existing proxy
+- Composing transports in flexible ways
+
+iroh's `Endpoint::builder` supports proxy configuration natively. The implementation is straightforward — pass the proxy URL to iroh's builder.
+
+## Decision
+Support `--transport iroh --proxy socks5://...` natively in the CLI. This works because iroh's endpoint builder accepts a proxy configuration, so the implementation is minimal: parse the proxy URL and pass it to the endpoint builder.
+
+For other transport combinations (TCP+TLS is already implicit — TLS wraps TCP), the `--proxy` flag applies to outbound connections from the SSH client or iroh endpoint.
+
+## Consequences
+- **Positive**: Flexible transport composition without requiring separate manual configuration.
+- **Positive**: Matches user expectation from the overview doc's transport chaining example.
+- **Positive**: Implementation is minimal — iroh already supports proxy config.
+- **Negative**: Slightly more CLI surface area (`--proxy` interaction with `--transport`).
+
+## References
+- [transport.md](../transport.md)
+- [OQ-05](../open-questions.md) — resolved by this ADR