feat(core): implement StaticConfig/DynamicConfig split with ArcSwap hot-reload

Split alknet-core configuration into StaticConfig (immutable after startup)
and DynamicConfig (hot-reloadable at runtime via ArcSwap).

- Add StaticConfig struct in config/static_config.rs with all fields per ADR-030
- Add DynamicConfig struct with AuthPolicy, ForwardingPolicy, RateLimitConfig
- Add ForwardingPolicy with allow_all()/deny_all() defaults (ADR-031)
- Add ConfigReloadHandle with reload() method for runtime config updates
- Replace Arc<ServerAuthConfig> with Arc<ArcSwap<DynamicConfig>> in ServerHandler
- Add config_reload_handle() to Server for obtaining reload handles
- Add AuthPolicy with authenticate_publickey/authenticate_certificate methods
- All existing tests pass with the new config structure
- Default DynamicConfig produces identical behavior to current code

crates/alknet-core/src/server/channel_proxy.rs

@@ -46,7 +46,10 @@ async fn connect_direct(target: SocketAddr) -> Result<TcpStream, ChannelProxyErr
         .map_err(|e| map_connection_error(e, target))
 }
 
-async fn connect_socks5(target: SocketAddr, proxy_addr: SocketAddr) -> Result<TcpStream, ChannelProxyError> {
+async fn connect_socks5(
+    target: SocketAddr,
+    proxy_addr: SocketAddr,
+) -> Result<TcpStream, ChannelProxyError> {
     let mut stream = TcpStream::connect(proxy_addr)
         .await
         .map_err(ChannelProxyError::from)?;
@@ -134,10 +137,7 @@ async fn connect_http_connect(
     }
 
     let response_str = String::from_utf8_lossy(&response);
-    let status_line = response_str
-        .lines()
-        .next()
-        .unwrap_or("");
+    let status_line = response_str.lines().next().unwrap_or("");
 
     if status_line.contains("200") {
         Ok(stream)
@@ -279,11 +279,7 @@ mod tests {
             .parse()
             .unwrap();
 
-            let reply = vec![
-                0x05, 0x00, 0x00, 0x01,
-                0, 0, 0, 0,
-                0, 0,
-            ];
+            let reply = vec![0x05, 0x00, 0x00, 0x01, 0, 0, 0, 0, 0, 0];
             proxy_sock.write_all(&reply).await.unwrap();
 
             let mut target_stream = TcpStream::connect(target).await.unwrap();
@@ -323,11 +319,7 @@ mod tests {
             let mut port_bytes = [0u8; 2];
             proxy_sock.read_exact(&mut port_bytes).await.unwrap();
 
-            let reply = vec![
-                0x05, 0x05, 0x00, 0x01,
-                0, 0, 0, 0,
-                0, 0,
-            ];
+            let reply = vec![0x05, 0x05, 0x00, 0x01, 0, 0, 0, 0, 0, 0];
             proxy_sock.write_all(&reply).await.unwrap();
         });
 
@@ -560,4 +552,4 @@ mod tests {
         let proxy = direct_config();
         proxy_channel(channel, target, &proxy).await;
     }
-}
+}