Implement server rate limiting and fail2ban-friendly structured logging

Add ConnectionRateLimiter (HashMap<IpAddr, usize>) and AuthAttemptLimiter
with check/on_connect/on_disconnect and check/on_failure methods.
Integrate into ServerHandler with structured tracing::info! logging for
auth attempts, connection opened/closed events. No logging of tunnel
destinations per ADR-006. Also add ForwardError type and fix type
annotation in forward.rs to unblock compilation.

crates/wraith-core/src/server/mod.rs

@@ -1,3 +1,5 @@
 pub mod handler;
+pub mod rate_limit;
 
-pub use handler::{ProxyConfig, ProxyMode, ServerHandler};
+pub use handler::{ProxyConfig, ProxyMode, ServerHandler, TransportKind};
+pub use rate_limit::{AuthAttemptLimiter, ConnectionRateLimiter};