refactor!: rebrand wraith to alknet

Rename all crates, CLI commands, constants, type names, doc comments,
and documentation from wraith to alknet. Includes wire-protocol changes:
ALPN wraith-ssh -> alknet-ssh, reserved destination prefix wraith- ->
alknet-, SSH auth username wraith -> alknet.

tasks/cli/connect-command.md

@@ -1,6 +1,6 @@
 ---
 id: cli/connect-command
-name: Implement `wraith connect` CLI subcommand with clap
+name: Implement `alknet connect` CLI subcommand with clap
 status: pending
 depends_on:
   - client/connect-options
@@ -12,15 +12,15 @@ level: implementation
 
 ## Description
 
-Implement the `wraith connect` CLI subcommand using `clap` with derive macros. Translates `ConnectOptions` into CLI flags and runs the client session. All options from client.md CLI interface must be supported.
+Implement the `alknet connect` CLI subcommand using `clap` with derive macros. Translates `ConnectOptions` into CLI flags and runs the client session. All options from client.md CLI interface must be supported.
 
-Environment variable defaults: `WRAITH_SERVER`, `WRAITH_IDENTITY` as convenience defaults per ADR-011.
+Environment variable defaults: `ALKNET_SERVER`, `ALKNET_IDENTITY` as convenience defaults per ADR-011.
 
 `--proxy` with `--transport tcp` should warn or be a no-op (ADR-019: client proxy wraps transport, and TCP transport is already direct).
 
 ## Acceptance Criteria
 
-- [ ] `wraith connect` subcommand flags match client.md CLI interface: `--server`, `--peer`, `--transport`, `--identity`, `--socks5`, `--forward`, `--remote-forward`, `--proxy`, `--iroh-relay`, `--tls-server-name`, `--insecure`
+- [ ] `alknet connect` subcommand flags match client.md CLI interface: `--server`, `--peer`, `--transport`, `--identity`, `--socks5`, `--forward`, `--remote-forward`, `--proxy`, `--iroh-relay`, `--tls-server-name`, `--insecure`
 - [ ] `--server` required for tcp/tls transport (validated at parse time or runtime)
 - [ ] `--peer` required for iroh transport (validated)
 - [ ] `--identity` required for all transports
@@ -28,11 +28,11 @@ Environment variable defaults: `WRAITH_SERVER`, `WRAITH_IDENTITY` as convenience
 - [ ] `--socks5` defaults to `127.0.0.1:1080`
 - [ ] `--forward` is repeatable (clap `multiple_occurrences`)
 - [ ] `--remote-forward` is repeatable
-- [ ] Environment variable defaults: `WRAITH_SERVER` for `--server`, `WRAITH_IDENTITY` for `--identity`
+- [ ] Environment variable defaults: `ALKNET_SERVER` for `--server`, `ALKNET_IDENTITY` for `--identity`
 - [ ] `--proxy` with `--transport tcp` prints warning (ADR-019: effectively no-op)
 - [ ] CLI translates args into `ConnectOptions` and calls `ClientSession::new(opts).run().await`
 - [ ] Errors reported to stderr with non-zero exit code
-- [ ] `cargo run -p wraith -- connect --help` shows all flags with descriptions
+- [ ] `cargo run -p alknet -- connect --help` shows all flags with descriptions
 
 ## References
 

tasks/cli/serve-command.md

@@ -1,6 +1,6 @@
 ---
 id: cli/serve-command
-name: Implement `wraith serve` CLI subcommand with clap
+name: Implement `alknet serve` CLI subcommand with clap
 status: completed
 depends_on:
   - server/serve-loop
@@ -12,16 +12,16 @@ level: implementation
 
 ## Description
 
-Implement the `wraith serve` CLI subcommand using `clap` with derive macros. This translates `ServeOptions` into CLI flags and runs the server. All options from server.md CLI interface must be supported.
+Implement the `alknet serve` CLI subcommand using `clap` with derive macros. This translates `ServeOptions` into CLI flags and runs the server. All options from server.md CLI interface must be supported.
 
 Environment variable defaults: none mandated for serve, but consistent with programmatic-first API.
 
-The binary is the `wraith` crate at `crates/wraith/src/main.rs`.
+The binary is the `alknet` crate at `crates/alknet/src/main.rs`.
 
 ## Acceptance Criteria
 
-- [x] `crates/wraith/src/main.rs` defines CLI with clap derive: `wraith` with `serve` and `connect` subcommands (connect stub for now)
-- [x] `wraith serve` subcommand flags match server.md CLI interface exactly: `--key`, `--authorized-keys`, `--cert-authority`, `--transport`, `--listen`, `--tls-cert`, `--tls-key`, `--acme-domain`, `--stealth`, `--proxy`, `--iroh-relay`, `--max-connections-per-ip`, `--max-auth-attempts`
+- [x] `crates/alknet/src/main.rs` defines CLI with clap derive: `alknet` with `serve` and `connect` subcommands (connect stub for now)
+- [x] `alknet serve` subcommand flags match server.md CLI interface exactly: `--key`, `--authorized-keys`, `--cert-authority`, `--transport`, `--listen`, `--tls-cert`, `--tls-key`, `--acme-domain`, `--stealth`, `--proxy`, `--iroh-relay`, `--max-connections-per-ip`, `--max-auth-attempts`
 - [x] `--key` is required (no default)
 - [x] `--transport` defaults to `tcp`
 - [x] `--listen` defaults to `0.0.0.0:22`
@@ -31,7 +31,7 @@ The binary is the `wraith` crate at `crates/wraith/src/main.rs`.
 - [x] Key inputs accept file paths (strings); in-memory key data is a library/API concern, not CLI
 - [x] CLI translates args into `ServeOptions` and calls `Server::new(opts).run().await`
 - [x] Errors reported to stderr with non-zero exit code
-- [x] `cargo run -p wraith -- serve --help` shows all flags with descriptions
+- [x] `cargo run -p alknet -- serve --help` shows all flags with descriptions
 
 ## References
 
@@ -44,4 +44,4 @@ All 12 CLI flags implemented. ServeTransportModeArg ValueEnum maps to ServeTrans
 
 ## Summary
 
-Implemented wraith serve CLI subcommand with all server.md flags. Clap derive with ServeTransportModeArg, stealth validation, ACME feature gate, iroh endpoint ID printing. Build/clippy/test pass across all feature combinations.
+Implemented alknet serve CLI subcommand with all server.md flags. Clap derive with ServeTransportModeArg, stealth validation, ACME feature gate, iroh endpoint ID printing. Build/clippy/test pass across all feature combinations.