Extract SshInterface from ServerHandler, add RawFramingInterface stub

- SshInterface implements Interface trait with accept() method
- SshSession implements InterfaceSession trait (stub for call protocol events)
- RawFramingInterface is type-only stub (Phase 4+ for DNS, WebTransport)
- TransportKind consolidated into transport module with Display, PartialEq, Eq
- ListenerConfig gains interface_kind field for (Transport, Interface) pairs
- SshInterface wraps existing russh handler logic (SshHandler)
- Auth delegation through IdentityProvider (not embedded in SshInterface)
- Channel routing through session to Layer 3 (forwarding policy)
- Server accept loop uses (Transport, Interface) pairs

Per ADR-026: SSH is Layer 2, not Layer 1. This is the highest-risk Phase 1
task, implementing the Interface trait to separate transport from interface.

crates/alknet-core/src/server/mod.rs

@@ -19,9 +19,11 @@ pub use control_channel::{
     is_reserved_destination, ControlChannelHandler, ControlChannelRouter, DuplexStream,
     ALKNET_CONTROL_DESTINATION, ALKNET_PREFIX,
 };
-pub use handler::{ProxyConfig, ProxyMode, ServerHandler, TransportKind};
+pub use handler::{ProxyConfig, ProxyMode, ServerHandler};
 pub use rate_limit::{AuthAttemptLimiter, ConnectionRateLimiter};
 pub use serve::{ListenerConfig, ServeError, ServeOptions, ServeTransportMode, Server};
+
+pub use crate::transport::TransportKind;
 pub use stealth::{
     detect_protocol, send_fake_nginx_404, validate_stealth_config, ProtocolDetection,
 };