Update architecture specs to reflect live deployment findings and fix two bugs

Architecture updates based on gaps discovered during live deployment testing:

- ADR-023: HTTP/2 client-facing support via ALPN-based protocol detection.
  The spec previously said HTTP/2 was out of scope, but the deployment
  revealed that modern browsers negotiate HTTP/2 via ALPN. The proxy now
  correctly detects the negotiated ALPN protocol and uses the appropriate
  HTTP server builder (http2::Builder for h2, auto::Builder for http/1.1).
  Upstream connections remain HTTP/1.1. Host resolution now falls back to
  URI host for HTTP/2 :authority pseudo-headers.

- ADR-024: ANSI-disabled logging. All tracing-subscriber layers now use
  with_ansi(false) to prevent ANSI escape codes in log output, which broke
  fail2ban regex matching in Docker deployments. Also documents the fail2ban
  regex anchor fix (^RATE_LIMIT → RATE_LIMIT).

Bug fixes found by architecture review:

- Fix missing ALPN protocols in manual TLS mode. build_manual_server_config
  and build_multi_domain_server_config did not set alpn_protocols, meaning
  manual TLS mode could not support HTTP/2. Added h2 and http/1.1 ALPN
  entries to both functions (acme-tls/1 only in ACME mode).

- Fix missing with_ansi(false) in JSON log format. The init_json function
  with file output did not disable ANSI on stdout or file layers, which would
  break fail2ban in production JSON logging mode.

Other spec updates:

- All document statuses updated from draft to reviewed
- proxy.md: documented Server header removal, upstream HTTPS client,
  two-phase timeout enforcement, HTTP/2 host resolution, connect timeout
- tls.md: documented ALPN configuration differing by mode (ACME vs manual)
- overview.md: added HTTP/2 client-facing support to scope, updated crate
  deps (hyper-rustls, rustls-native-certs, hyper-util), clarified out-of-scope
- config.md: fixed http_port type (u16→u32) to match implementation, added
  ANSI-disabled note for LoggingConfig
- operations.md: documented ANSI-disabled logging, fail2ban regex anchor
- open-questions.md: updated OQ-09 resolution (connect timeout fully
  implemented), OQ-10 (C2 bug is fixed)

src/logging/mod.rs

@@ -39,9 +39,11 @@ fn init_json(env_filter: EnvFilter, log_file_path: &Option<String>, level: Level
             let file_env_filter = make_env_filter(level);
             let stdout_layer = tracing_subscriber::fmt::layer()
                 .json()
+                .with_ansi(false)
                 .with_filter(env_filter);
             let file_layer = tracing_subscriber::fmt::layer()
                 .json()
+                .with_ansi(false)
                 .with_writer(file_writer)
                 .with_filter(file_env_filter);
             tracing_subscriber::registry()

src/tls/config.rs

@@ -67,6 +67,11 @@ pub fn build_manual_server_config(cert_path: &str, key_path: &str) -> Result<Ser
         .with_single_cert(certs, key)
         .with_context(|| "failed to configure certificate/key pair")?;
 
+    let mut config = config;
+    // Advertise HTTP/2 and HTTP/1.1 via ALPN so clients can negotiate HTTP/2.
+    // Note: acme-tls/1 is NOT included here — it's only needed for ACME mode.
+    config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
+
     Ok(config)
 }
 
@@ -88,6 +93,11 @@ pub fn build_multi_domain_server_config(
         .with_no_client_auth()
         .with_cert_resolver(Arc::new(resolver));
 
+    let mut config = config;
+    // Advertise HTTP/2 and HTTP/1.1 via ALPN so clients can negotiate HTTP/2.
+    // Note: acme-tls/1 is NOT included here — it's only needed for ACME mode.
+    config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
+
     Ok(config)
 }