refactor!: rebrand wraith to alknet

Rename all crates, CLI commands, constants, type names, doc comments,
and documentation from wraith to alknet. Includes wire-protocol changes:
ALPN wraith-ssh -> alknet-ssh, reserved destination prefix wraith- ->
alknet-, SSH auth username wraith -> alknet.

tasks/auth/client-auth-handler.md

@@ -19,7 +19,7 @@ No password auth. The client handler is simpler than the server — it just need
 
 ## Acceptance Criteria
 
-- [ ] `crates/wraith-core/src/auth/client_auth.rs` exports `ClientAuthConfig` and client handler
+- [ ] `crates/alknet-core/src/auth/client_auth.rs` exports `ClientAuthConfig` and client handler
 - [ ] `ClientAuthConfig` holds: `private_key: KeyPair`, optional `public_key: PublicKey`
 - [ ] `ClientAuthConfig::from_key_source(source: KeySource) -> Result<Self>` — loads key via key-loading module
 - [ ] Implements `russh::client::Handler` with `auth_publickey()` returning the public key

tasks/auth/error-types.md

@@ -22,14 +22,14 @@ Use `thiserror` for structured error types propagated via `anyhow::Result` in th
 
 ## Acceptance Criteria
 
-- [ ] `crates/wraith-core/src/error.rs` exports error types
+- [ ] `crates/alknet-core/src/error.rs` exports error types
 - [ ] `TransportError` enum: `ConnectionFailed`, `HandshakeFailed`, `Timeout`, `ProxyFailed`
 - [ ] `AuthError` enum: `KeyRejected`, `CertInvalid`, `CertExpired`, `CertPrincipalMismatch`, `NoMatchingKey`
 - [ ] `ChannelError` enum: `TargetUnreachable`, `ProxyConnectFailed`, `ChannelClosed`
 - [ ] `ConfigError` enum: `InvalidFlag`, `KeyFileNotFound`, `BindFailed`, `IncompatibleOptions`
 - [ ] All error types implement `std::error::Error` via `thiserror`, `Display`, and `Debug`
 - [ ] Error types have `source` chaining where appropriate (e.g., `TransportError::HandshakeFailed { source: std::io::Error }`)
-- [ ] Re-exported from `crates/wraith-core/src/lib.rs`
+- [ ] Re-exported from `crates/alknet-core/src/lib.rs`
 - [ ] Unit tests for Display output of each error variant
 
 ## References

tasks/auth/key-loading.md

@@ -25,7 +25,7 @@ All keys must be in **OpenSSH key format** (not PEM/PKCS#1/PKCS#8). This module
 
 ## Acceptance Criteria
 
-- [ ] `crates/wraith-core/src/auth/keys.rs` exports key loading functions
+- [ ] `crates/alknet-core/src/auth/keys.rs` exports key loading functions
 - [ ] `KeySource` enum: `File(PathBuf)` and `Memory(Vec<u8>)` for unified key input handling
 - [ ] `load_private_key(source: KeySource) -> Result<russh::key::KeyPair>` — loads OpenSSH private key from file or memory
 - [ ] `load_public_keys(source: KeySource) -> Result<Vec<russh::key::PublicKey>>` — loads one or more public keys from authorized_keys format

tasks/auth/server-auth-handler.md

@@ -22,7 +22,7 @@ No password authentication over SSH. This is the `russh::server::Handler::auth_p
 
 ## Acceptance Criteria
 
-- [ ] `crates/wraith-core/src/auth/server_auth.rs` exports `ServerAuthConfig` and auth logic
+- [ ] `crates/alknet-core/src/auth/server_auth.rs` exports `ServerAuthConfig` and auth logic
 - [ ] `ServerAuthConfig` holds: `authorized_keys: HashSet<PublicKey>`, `cert_authorities: Vec<CertAuthorityEntry>`
 - [ ] `ServerAuthConfig::from_keys_and_ca()` constructor: loads authorized keys and cert-authority entries from provided key sources
 - [ ] Auth check function: given a presented key/certificate, return `Accept` or `Reject`