Decompose security review #003 findings into 17 fix tasks and 1 review task

Address 4 critical, 8 warning, and 5 suggestion findings from the
security and bug review by creating atomic, dependency-ordered tasks:

Critical fixes (C1-C4): rate limiter IP source (ADR-025), InFlightCounter
increment + drain interval, connector timeout ceiling (ADR-026), JSON format
without log file.

Validation tightening (W1, W2): upstream host validation, ACME contact email
validation.

Robustness (W3, W4, W5, W12): upstream URI error handling (502 not silent
drop), admin socket resource limits (ADR-027), TlsMode wildcard mismatch,
http_port u32→u16.

Code quality (W6, W10, W11, S1, S3, W8/W9): config type consolidation,
TokenBucket field visibility, reload_mutex #[cfg(test)], dead code removal,
root cert count logging, misleading test names.

Test coverage (S10): rate limiter ConnectInfo tests (depends on C1 fix).

Review: post-security-fix-review checkpoint covering all critical fixes
and sensitive config consolidation path.

tasks/fix/json-format-without-logfile.md

@@ -0,0 +1,58 @@
+---
+id: fix/json-format-without-logfile
+name: Fix JSON format not applied when no log file is configured (C4)
+status: pending
+depends_on: []
+scope: single
+risk: trivial
+impact: isolated
+level: implementation
+review_findings: [C4]
+---
+
+## Description
+
+When `format = "json"` is configured but no `log_file_path` is set, the `None`
+branch of `init_json` creates a layer **without** calling `.json()`. The output
+is plain text, not JSON. The `format = "json"` config value is silently ignored.
+
+The spec (operations.md) states: "Both output destinations must respect the
+`format` config value: when `format = "json"`, both file and stdout output must
+use JSON formatting."
+
+### Changes Required
+
+**`src/logging/mod.rs`** — `init_json` function, `None` branch (lines 54-58):
+- Add `.json()` to the stdout-only layer:
+  ```rust
+  None => {
+      let layer = tracing_subscriber::fmt::layer()
+          .json()
+          .with_ansi(false)
+          .with_filter(env_filter);
+      tracing_subscriber::registry().with(layer).try_init()?;
+  }
+  ```
+
+## Acceptance Criteria
+
+- [ ] `.json()` is called in the `None` branch of `init_json`
+- [ ] `format = "json"` with no `log_file_path` produces JSON output on stdout
+- [ ] `format = "json"` with `log_file_path` still produces JSON on both outputs
+- [ ] `format = "text"` paths are unchanged
+- [ ] `cargo test` passes
+- [ ] `cargo clippy` passes with no warnings
+
+## References
+
+- docs/architecture/operations.md — logging output, format guarantee
+- docs/reviews/003-security-and-bug-review.md — C4 finding
+- src/logging/mod.rs — `init_json` function
+
+## Notes
+
+> To be filled on completion
+
+## Summary
+
+> To be filled on completion