Decompose architecture into 23 atomic tasks across 7 parallel generations

Task graph covers all Phase 1 concerns: config system, TLS termination,
proxy handler, operations (rate limiting, logging, health check, admin
socket, signals, shutdown, body size limit), deployment artifacts, and
two review checkpoints.

No circular dependencies. Critical path length of 7. Risk distribution:
3 high-risk (ACME, TLS listener setup, startup orchestration), 7 medium,
11 low, 2 trivial.

tasks/config/cli-parsing.md

@@ -0,0 +1,64 @@
+---
+id: config/cli-parsing
+name: Implement CLI argument parsing with clap and config file loading
+status: pending
+depends_on: [config/static-config, config/validation]
+scope: narrow
+risk: low
+impact: component
+level: implementation
+---
+
+## Description
+
+Implement the CLI entry point using `clap` with derive macros. The CLI reads the config file, deserializes both static and dynamic portions, validates, and returns the parsed config.
+
+### CLI Interface
+
+```
+reverse-proxy [OPTIONS]
+
+Options:
+  --config <PATH>              Path to config file [default: /etc/reverse-proxy/config.toml]
+  --validate                   Validate config and exit
+  --allow-wildcard-bind        Permit 0.0.0.0 as a bind address (for container deployments)
+  --help                       Show help
+  --version                    Show version
+```
+
+The `--allow-wildcard-bind` flag is OR'd with the config `allow_wildcard_bind` field — if either is set, wildcard binding is allowed.
+
+### Behavior
+
+- `--validate`: Load and validate the config, print success or errors, exit 0 or 1
+- Normal run: Load, validate, return config for the startup sequence
+- Config file not found: exit with error
+- Config validation fails: exit with code 1 and log all errors
+
+## Acceptance Criteria
+
+- [ ] `clap` with derive macros for CLI parsing
+- [ ] `--config` flag with default `/etc/reverse-proxy/config.toml`
+- [ ] `--validate` flag: loads, validates, reports, exits
+- [ ] `--allow-wildcard-bind` flag: OR'd with config value
+- [ ] `--version` prints version from `Cargo.toml`
+- [ ] Config file loading and TOML deserialization
+- [ ] Validation runs on every load (startup and `--validate`)
+- [ ] Error messages are clear and actionable
+- [ ] Unit tests for CLI argument parsing
+- [ ] Integration test: `--validate` with valid config exits 0
+- [ ] Integration test: `--validate` with invalid config exits 1 and reports errors
+
+## References
+
+- docs/architecture/operations.md — CLI interface
+- docs/architecture/config.md — config loading, validation
+- docs/architecture/decisions/016-explicit-bind-address.md — `allow_wildcard_bind`
+
+## Notes
+
+> To be filled by implementation agent
+
+## Summary
+
+> To be filled on completion