task 1: S-1 remediation — no-pop posture doc + OQ-TLS-09 + permanent impersonation pin

- AcceptAnyCertVerifier doc: the presented CertificateVerify signature
  is not verified (no proof-of-possession) — the server-extracted
  fingerprint is attacker-suppliable from observed public cert/SPKI
  bytes; states the two safe patterns (auth-layer challenge-response /
  a verifying verifier) and points at OQ-TLS-09
- FingerprintPinVerifier doc (N-1): fixed the "stolen-but-stale
  fingerprint" phrasing (the cert is presented fresh each handshake;
  the signature check defeats a stolen/observed cert used by a party
  without the private key) and added the server-verifier cross-reference
- OQ-TLS-09 recorded (open, high): which layer owns server-path
  proof-of-possession — three options; deferral noted (needs the
  auth-layer design or an API call before the first consumer)
- tests/impersonation_posture.rs (tcp-gated): the S-1 probe made
  permanent, both variants — X.509 victim cert + attacker key and RFC
  7250 victim SPKI + attacker key complete the handshake, application
  data flows, and the server extracts the victim's fingerprint; any
  future pop change must fail/update this test with the doc + OQ
- server.md / client.md synced with the same posture
- task note: the review's N-4 parenthetical ("alknet's client resolver
  offers both types") is inaccurate — rustls 0.23.41/0.23.44 offer
  [RawPublicKey] iff the resolver's only_raw_public_keys() is true;
  task 6 should write N-4 from the rustls sources

Verified: cargo test 68 default / 77 all-features (+2) green; clippy
-D warnings clean (default + all-features); fmt clean; cargo doc
--no-deps warning-free

docs/architecture/client.md

@@ -89,9 +89,12 @@ verification — only the pin.
 
 Handshake signatures are still verified (TLS 1.2/1.3, aws-lc-rs
 algorithms; Ed25519 SPKI certs route through
-`verify_tls13_signature_with_raw_key`): a stolen fingerprint cannot
-be replayed with a forged signature — the presenter must prove
-possession of the corresponding private key.
+`verify_tls13_signature_with_raw_key`): the presenter must prove
+possession of the corresponding private key, so a stolen or observed
+certificate cannot be used by a party that does not hold the matching
+key. This verifier checks proof-of-possession; the server-side
+`AcceptAnyCertVerifier` does not (see
+[server.md](server.md), OQ-TLS-09).
 
 ## The root-store fallback (alknet ADR-088 §5)