generation 3: port server + client — the two big ports

port-server (src/server.rs, 614 lines):
- TlsServerConfig with ADR-004 accessors: for_noq(&self) (borrow +
  inner-clone + NoqWrap via #[from]), for_tcp_tls(&self) adopted
  (infallible TlsAcceptor), rustls_config(&self) adopted
- acme_handle renamed per ADR-006; the defensive Acme arm returns
  TlsError::AcmeConfig (unreachable! eliminated)
- error sites remapped to typed variants (Rustls/SelfSigned/AcmeConfig)
- ACME path verbatim: DirCache + directory + contacts + resolver +
  acme-tls/1 + spawned event loop (tracing lines ported), returns
  immediately, detached handle
- 14 tests incl. the nine-scheme exact-list pin, ACME
  spawn/return/ALPN assertion (blackhole URL — no network I/O),
  no-feature AcmeConfig, for_tcp_tls/rustls_config round-trips

port-client (src/credentials.rs + src/client.rs):
- ConnectionCredentials/RemoteIdentity wholesale with load-bearing
  Option-semantics docs (None = public-X.509 state, Some = pin)
- verifier selection matrix + client-auth presentation matrix
  test-pinned at unit level; enable_early_data=true pinned;
  root-store fallback asserted non-empty
- FingerprintPinVerifier: pin match/mismatch + raw-key signature
  routing (verify_tls13_signature_with_raw_key) asserted
- resolvers/verifier made pub for the re-export block

Cargo.toml (two required deltas):
- noq feature gains aws-lc-rs: lockfile resolves noq-proto 1.3.0
  where ServerConfig::with_crypto is #[cfg(any(aws-lc-rs, ring))];
  ADR-003's TOML block was written against the 1.2 API. Amendment
  note recorded in tasks/port-server.md for the review-impl sync
- acme = [dep:rustls-acme, dep:futures] — ADR-006 already gates
  the futures dep on acme; the scaffold omitted it

lib.rs: re-export block complete (all eight modules)

Verification: cargo test 68, --all-features 75, --features noq 72,
clippy -D warnings, fmt --check, doc --no-deps (0 warnings) — green

Cargo.toml

@@ -17,7 +17,7 @@ name = "alktls"
 default = []
 noq = ["dep:noq", "dep:noq-proto"]
 tcp = ["dep:tokio-rustls"]
-acme = ["dep:rustls-acme"]
+acme = ["dep:rustls-acme", "dep:futures"]
 
 [dependencies]
 tokio = { version = "1", default-features = false, features = ["rt", "sync", "macros"] }
@@ -35,7 +35,7 @@ tracing = "0.1"
 thiserror = "2"
 
 futures = { version = "0.3", optional = true }
-noq = { version = "1.2", optional = true, default-features = false, features = ["rustls"] }
+noq = { version = "1.2", optional = true, default-features = false, features = ["rustls", "aws-lc-rs"] }
 noq-proto = { version = "1.2", optional = true, default-features = false }
 tokio-rustls = { version = "0.26", optional = true }
 rustls-acme = { version = "0.12", optional = true, features = ["aws-lc-rs"] }