feat(core): implement StaticConfig/DynamicConfig split with ArcSwap hot-reload

Split alknet-core configuration into StaticConfig (immutable after startup)
and DynamicConfig (hot-reloadable at runtime via ArcSwap).

- Add StaticConfig struct in config/static_config.rs with all fields per ADR-030
- Add DynamicConfig struct with AuthPolicy, ForwardingPolicy, RateLimitConfig
- Add ForwardingPolicy with allow_all()/deny_all() defaults (ADR-031)
- Add ConfigReloadHandle with reload() method for runtime config updates
- Replace Arc<ServerAuthConfig> with Arc<ArcSwap<DynamicConfig>> in ServerHandler
- Add config_reload_handle() to Server for obtaining reload handles
- Add AuthPolicy with authenticate_publickey/authenticate_certificate methods
- All existing tests pass with the new config structure
- Default DynamicConfig produces identical behavior to current code

crates/alknet-core/src/client/forward.rs

@@ -205,12 +205,7 @@ async fn proxy_local_to_remote<H: client::Handler + Send + 'static>(
 
     let handle_guard = handle.lock().await;
     let channel = handle_guard
-        .channel_open_direct_tcpip(
-            remote_host,
-            remote_port as u32,
-            &local_addr,
-            0,
-        )
+        .channel_open_direct_tcpip(remote_host, remote_port as u32, &local_addr, 0)
         .await
         .map_err(|e| ForwardError::ChannelOpenFailed {
             source: Box::new(e) as _,
@@ -470,11 +465,8 @@ mod tests {
         let bound_addr = listener.local_addr().unwrap();
         drop(listener);
 
-        let spec = PortForwardSpec::local(&format!(
-            "127.0.0.1:{}:remote:5432",
-            bound_addr.port()
-        ))
-        .unwrap();
+        let spec = PortForwardSpec::local(&format!("127.0.0.1:{}:remote:5432", bound_addr.port()))
+            .unwrap();
         let forwarder = LocalForwarder::new(spec).unwrap();
         assert_eq!(forwarder.local_port(), bound_addr.port());
     }
@@ -534,4 +526,4 @@ mod tests {
         let forwarder = RemoteForwarder::new(spec.clone()).unwrap();
         assert_eq!(forwarder.spec(), &spec);
     }
-}
+}