Add ADR-029/030, implementation tasks, and spec updates for admin socket removal

Security review #005 identified critical vulnerabilities in the Unix domain
socket admin API (C1 symlink race, C2 no auth, C3 info leak, W1-W7, S1-S6).
ADR-028 (already accepted) replaces the socket with an authenticated HTTP
admin API on the health check port. This commit adds the remaining spec work:

- ADR-029: Config file TOCTOU mitigation (mtime check on reload)
- ADR-030: Store cli_allow_wildcard_bind in ConfigReloadHandle for consistent
  reload validation
- Implementation tasks for the admin HTTP migration (fix/admin-http-api),
  TOCTOU fix (fix/config-reload-toctou), and wildcard flag fix
  (fix/wildcard-flag-reload)
- Updated review #005 status to resolved with per-finding disposition
- Resolved OQ-16: POST for state-changing admin endpoints, GET for read-only
- Updated all architecture docs to reference new ADRs, use admin_key_path
  instead of admin_socket_path, and reflect POST method for /admin/reload

docs/architecture/proxy.md

@@ -112,9 +112,9 @@ known host are forwarded to the upstream without modification.
 
 The proxy does **not** serve a `/health` route on the main listener. Health
 checking is an operational concern handled by the dedicated local health check
-port (default: 9900, bound to `127.0.0.1` only) and the admin socket's `status`
-command — not by intercepting traffic on the public-facing proxy. See ADR-013
-and ADR-022.
+port (default: 9900, bound to `127.0.0.1` only) and the admin HTTP endpoint's
+`/admin/status` (with Bearer token) — not by intercepting traffic on the
+public-facing proxy. See ADR-013, ADR-022, and ADR-028.
 
 ### 2. Rate Limiter IP Source
 
@@ -340,7 +340,7 @@ questions affecting this document:
   ADR-015: per-site timeout overrides with defaults)
 - ~~**OQ-08**: Should the `/health` path use a less common endpoint to avoid
   upstream collision?~~ (resolved — ADR-022: no `/health` route on the main
-  listener; health checking is via port 9900 and admin socket only)
+  listener; health checking is via port 9900 and admin HTTP endpoint only)
 - ~~**OQ-09**: How should `upstream_connect_timeout_secs` be enforced?~~
   (resolved — ADR-026: 30s connector ceiling, per-site timeout via
   `tokio::time::timeout`)