Phase 1, Task 1 of crate extraction. Creates the alknet-tls crate with: - Cargo.toml with all dependencies and feature flags (quinn, tcp, acme) - Module skeleton: server.rs, client.rs, signing.rs, pem.rs - Workspace membership in root Cargo.toml - rustls-native-certs and webpki-roots always-present (not feature-gated) - alknet-core dependency via workspace path