feat(core): implement StaticConfig/DynamicConfig split with ArcSwap hot-reload

Split alknet-core configuration into StaticConfig (immutable after startup)
and DynamicConfig (hot-reloadable at runtime via ArcSwap).

- Add StaticConfig struct in config/static_config.rs with all fields per ADR-030
- Add DynamicConfig struct with AuthPolicy, ForwardingPolicy, RateLimitConfig
- Add ForwardingPolicy with allow_all()/deny_all() defaults (ADR-031)
- Add ConfigReloadHandle with reload() method for runtime config updates
- Replace Arc<ServerAuthConfig> with Arc<ArcSwap<DynamicConfig>> in ServerHandler
- Add config_reload_handle() to Server for obtaining reload handles
- Add AuthPolicy with authenticate_publickey/authenticate_certificate methods
- All existing tests pass with the new config structure
- Default DynamicConfig produces identical behavior to current code

crates/alknet-core/src/server/stealth.rs

@@ -134,7 +134,10 @@ mod tests {
 
         let mut all_data = Vec::new();
         reader.read_to_end(&mut all_data).await.unwrap();
-        assert!(all_data.starts_with(banner), "banner bytes must be preserved after detection");
+        assert!(
+            all_data.starts_with(banner),
+            "banner bytes must be preserved after detection"
+        );
     }
 
     #[tokio::test]
@@ -142,7 +145,10 @@ mod tests {
         let (client, server) = duplex(1024);
         let (mut client_read, mut client_write) = tokio::io::split(client);
 
-        client_write.write_all(b"GET / HTTP/1.1\r\nHost: example.com\r\n\r\n").await.unwrap();
+        client_write
+            .write_all(b"GET / HTTP/1.1\r\nHost: example.com\r\n\r\n")
+            .await
+            .unwrap();
         drop(client_write);
 
         let (detection, mut reader) = detect_protocol(server).await;
@@ -206,7 +212,10 @@ mod tests {
         let (client, server) = duplex(1024);
         let mut client = client;
 
-        client.write_all(b"GET / HTTP/1.1\r\nHost: example.com\r\n\r\n").await.unwrap();
+        client
+            .write_all(b"GET / HTTP/1.1\r\nHost: example.com\r\n\r\n")
+            .await
+            .unwrap();
 
         let (detection, mut reader) = detect_protocol(server).await;
         assert_eq!(detection, ProtocolDetection::Http);
@@ -223,4 +232,4 @@ mod tests {
         let result = client.read(&mut extra).await;
         assert!(result.is_err() || result.unwrap() == 0);
     }
-}
+}