tasks: decompose Phase 1 core modifications into 12 atomic implementation tasks

Phase 1 of the integration plan modifies alknet-core to support the
architectural changes from Phase 0 ADRs and specs. Decomposed into
dependency-ordered tasks across config split, identity, forwarding
policy, OperationEnv, interface abstraction, and NAPI reload API.

Critical path: config-split → identity → forwarding → wire-into-handler
→ interface-trait → ssh-interface-extraction → review.

Two highest-risk tasks (interface-trait-definition, ssh-interface-extraction)
are split from §1.8 per the integration plan's note that it may need
sub-phases. OperationEnv is split into types and runtime per Phase 1
local-dispatch-only constraint.

tasks/core/napi-reload-api.md

@@ -0,0 +1,46 @@
+---
+id: core/napi-reload-api
+name: Add NAPI reload API for DynamicConfig and ForwardingPolicy
+status: pending
+depends_on:
+  - core/config-identity-provider-into-handler
+  - core/multi-transport-listeners
+scope: narrow
+risk: low
+impact: component
+level: implementation
+---
+
+## Description
+
+Expose `reloadAuth()`, `reloadForwarding()`, and `reloadAll()` on the NAPI `AlknetServer` object, per configuration.md and napi-and-pubsub.md updates.
+
+**Key changes**:
+- `AlknetServer` NAPI object holds a `ConfigReloadHandle` (from task 1.5)
+- `reloadAuth(config)`: creates new `AuthPolicy` and atomically swaps it via ArcSwap
+- `reloadForwarding(config)`: creates new `ForwardingPolicy` and atomically swaps it
+- `reloadAll(config)`: swaps the entire `DynamicConfig`
+- Call protocol integration: expose operation registry for NAPI consumers to register handlers (depends on operation-context-registry)
+
+## Acceptance Criteria
+
+- [ ] `AlknetServer` NAPI object has `reloadAuth()`, `reloadForwarding()`, `reloadAll()` methods
+- [ ] `reloadAuth()` creates new `AuthPolicy` from provided config and swaps via `ConfigReloadHandle`
+- [ ] `reloadForwarding()` creates new `ForwardingPolicy` and swaps via `ConfigReloadHandle`
+- [ ] `reloadAll()` swaps the entire `DynamicConfig`
+- [ ] All swaps are atomic via ArcSwap — existing connections continue, new connections get new config
+- [ ] NAPI type definitions for `ForwardingPolicyConfig` and auth config types
+- [ ] Existing NAPI tests pass
+
+## References
+
+- docs/architecture/configuration.md — NAPI Reload API
+- docs/architecture/napi-and-pubsub.md — NAPI layer additions
+
+## Notes
+
+> To be filled by implementation agent
+
+## Summary
+
+> To be filled on completion