feat(core): implement StaticConfig/DynamicConfig split with ArcSwap hot-reload

Split alknet-core configuration into StaticConfig (immutable after startup)
and DynamicConfig (hot-reloadable at runtime via ArcSwap).

- Add StaticConfig struct in config/static_config.rs with all fields per ADR-030
- Add DynamicConfig struct with AuthPolicy, ForwardingPolicy, RateLimitConfig
- Add ForwardingPolicy with allow_all()/deny_all() defaults (ADR-031)
- Add ConfigReloadHandle with reload() method for runtime config updates
- Replace Arc<ServerAuthConfig> with Arc<ArcSwap<DynamicConfig>> in ServerHandler
- Add config_reload_handle() to Server for obtaining reload handles
- Add AuthPolicy with authenticate_publickey/authenticate_certificate methods
- All existing tests pass with the new config structure
- Default DynamicConfig produces identical behavior to current code

crates/alknet-core/src/transport/mod.rs

@@ -13,13 +13,13 @@
 //! See [ADR-001](docs/architecture/decisions/001-pluggable-transport.md) and
 //! [ADR-004](docs/architecture/decisions/004-ssh-over-transport.md) for design rationale.
 
-mod tcp;
 #[cfg(feature = "iroh")]
 mod iroh_transport;
+mod tcp;
 
-pub use tcp::{TcpAcceptor, TcpTransport};
 #[cfg(feature = "iroh")]
 pub use iroh_transport::{IrohAcceptor, IrohTransport, ALPN as IROH_ALPN};
+pub use tcp::{TcpAcceptor, TcpTransport};
 
 #[cfg(feature = "tls")]
 mod tls;
@@ -89,12 +89,8 @@ pub struct TransportInfo {
 #[derive(Debug, Clone)]
 pub enum TransportKind {
     Tcp,
-    Tls {
-        server_name: Option<String>,
-    },
-    Iroh {
-        endpoint_id: String,
-    },
+    Tls { server_name: Option<String> },
+    Iroh { endpoint_id: String },
 }
 
 #[cfg(test)]
@@ -185,4 +181,4 @@ mod tests {
             assert_eq!(endpoint_id, "abc123");
         }
     }
-}
+}