feat(core): implement StaticConfig/DynamicConfig split with ArcSwap hot-reload

Split alknet-core configuration into StaticConfig (immutable after startup)
and DynamicConfig (hot-reloadable at runtime via ArcSwap).

- Add StaticConfig struct in config/static_config.rs with all fields per ADR-030
- Add DynamicConfig struct with AuthPolicy, ForwardingPolicy, RateLimitConfig
- Add ForwardingPolicy with allow_all()/deny_all() defaults (ADR-031)
- Add ConfigReloadHandle with reload() method for runtime config updates
- Replace Arc<ServerAuthConfig> with Arc<ArcSwap<DynamicConfig>> in ServerHandler
- Add config_reload_handle() to Server for obtaining reload handles
- Add AuthPolicy with authenticate_publickey/authenticate_certificate methods
- All existing tests pass with the new config structure
- Default DynamicConfig produces identical behavior to current code

crates/alknet-core/src/auth/mod.rs

@@ -8,5 +8,5 @@ pub mod keys;
 pub mod server_auth;
 
 pub use client_auth::{ClientAuthConfig, ClientHandler};
-pub use keys::{CertAuthorityEntry, KeySource, load_private_key, load_public_keys};
-pub use server_auth::ServerAuthConfig;
+pub use keys::{load_private_key, load_public_keys, CertAuthorityEntry, KeySource};
+pub use server_auth::ServerAuthConfig;