Resolve OQ-07: add multi-config listener support (ADR-019)

Introduce [[listeners]] configuration to support both dedicated-IP
(1 IP = 1 cert = 1 domain) and shared-IP (SAN certificate) deployment
models. Each listener is an independent TLS endpoint with its own bind
address, TLS config, and site routing. OQ-07 is now resolved.

Changes:
- Add ADR-019 for multi-config listener support
- Update config format from [server] to [[listeners]] entries
- Update tls.md for per-listener TLS and certificate provisioning
- Update overview.md architecture diagram and scope
- Update proxy.md for per-listener HTTP redirect
- Fix stale references in ADR-010, ADR-011, ADR-016
- Update OQ-05 resolution (per-listener bind_addr supersedes)
- Add unique-host rationale to config validation rules
- Architecture review: fix all 3 critical and 6 warning issues

docs/architecture/decisions/011-multi-domain-tls.md

@@ -30,23 +30,22 @@ certificate covering all proxied domains. Manual mode uses certificate file
 paths (single cert file with all domains, or one cert per domain resolved via
 SNI).
 
-The config format changes from the previous single-domain format:
+With ADR-019, TLS configuration lives inside `[[listeners]]` entries. Each
+listener has its own TLS mode and domain list. The config format is:
 
 ```toml
-# Previous (single-domain) format — no longer used
-[tls]
-mode = "acme"
-acme_domain = "git.alk.dev"  # single string
-```
+# Current format (after ADR-019)
+[[listeners]]
+bind_addr = "203.0.113.10"
 
-To the current multi-domain format:
-
-```toml
-[tls]
+[listeners.tls]
 mode = "acme"
 acme_domains = ["git.alk.dev", "alk.dev"]  # array of strings
 ```
 
+The previous single-listener format (pre-ADR-019) used a `[server.tls]` section
+which is no longer valid.
+
 In ACME mode, `rustls-acme` provisions a single certificate covering all
 listed domains via Subject Alternative Names (SAN). This is the standard
 Let's Encrypt approach for multi-domain certificates.
@@ -82,11 +81,12 @@ certificate or separate certificates resolved via SNI).
   domains must be validated) — mitigated by Let's Encrypt's domain-level
   validation
 - Per-site TLS configuration (e.g., a domain with a manual cert) requires a
-  future config extension (OQ-07)
+  future config extension — addressed by ADR-019 (multi-config listeners)
 
 ## References
 
 - [tls.md](../tls.md)
 - [config.md](../config.md)
 - ADR-010 (multi-site in Phase 1)
-- ADR-004 (ACME-primary certificate management)
+- ADR-004 (ACME-primary certificate management)
+- ADR-019 (multi-config listener support)