Extract SshInterface from ServerHandler, add RawFramingInterface stub

- SshInterface implements Interface trait with accept() method
- SshSession implements InterfaceSession trait (stub for call protocol events)
- RawFramingInterface is type-only stub (Phase 4+ for DNS, WebTransport)
- TransportKind consolidated into transport module with Display, PartialEq, Eq
- ListenerConfig gains interface_kind field for (Transport, Interface) pairs
- SshInterface wraps existing russh handler logic (SshHandler)
- Auth delegation through IdentityProvider (not embedded in SshInterface)
- Channel routing through session to Layer 3 (forwarding policy)
- Server accept loop uses (Transport, Interface) pairs

Per ADR-026: SSH is Layer 2, not Layer 1. This is the highest-risk Phase 1
task, implementing the Interface trait to separate transport from interface.

crates/alknet-core/src/transport/mod.rs

@@ -86,7 +86,7 @@ pub struct TransportInfo {
 /// Each variant identifies the transport mechanism. Used by the
 /// server handler for logging and authorization decisions.
 /// See ADR-001 and ADR-004.
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub enum TransportKind {
     Tcp,
     Tls { server_name: Option<String> },
@@ -95,6 +95,18 @@ pub enum TransportKind {
     WebTransport { host: String },
 }
 
+impl std::fmt::Display for TransportKind {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            TransportKind::Tcp => write!(f, "tcp"),
+            TransportKind::Tls { .. } => write!(f, "tls"),
+            TransportKind::Iroh { .. } => write!(f, "iroh"),
+            TransportKind::Dns { .. } => write!(f, "dns"),
+            TransportKind::WebTransport { .. } => write!(f, "webtransport"),
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;