docs(arch): alknet-tls review fixes — dep claim, Clone clarity, dedup, ADR refs

C1: Correct dep-change claim — only rustls-pemfile, rcgen, rustls-acme
leave core; quinn, iroh, ed25519-dalek stay (endpoint struct, accept
loops, and Ed25519SecretKey remain in core).

W1: Trim duplicated 'Why' section in README to summary + ADR-082 link;
keep the three-use-cases table as reference.

W2: Clarify TlsServerConfig is not Clone (holds JoinHandle); share via
Arc, accessors clone the inner rustls::ServerConfig. Fix in README and
ADR-082.

W6: Resolve futures dep inconsistency — acme-gated in both README and ADR.

S1: Behavior-preservation invariants now reference ADR-027 as their
origin.

S2: Document for_quinn fallibility (QuicServerConfig::try_from can fail)
vs for_tcp_tls infallibility (TlsAcceptor::new cannot fail).

docs/architecture/decisions/082-alknet-tls-extraction.md

@@ -82,7 +82,9 @@ that case, the same `Ed25519SecretKey` feeds both `TlsServerConfig::new`
 A new crate `alknet-tls` holds the TLS setup code extracted from
 `alknet-core/endpoint.rs`. The central type is `TlsServerConfig`, built
 once from a `TlsIdentity` + ALPN list, shared across transports via
-cheap clones.
+`Arc<TlsServerConfig>`. `TlsServerConfig` is not `Clone` (it holds a
+`JoinHandle`); each transport accessor clones the inner
+`rustls::ServerConfig`, which is cheap (Arc-shared cert resolver).
 
 ```rust
 pub struct TlsServerConfig {