Decompose implementation review fixes into 14 atomic tasks with post-fix review

Break down findings from review #002 into dependency-ordered fix tasks:

Critical/High:
- fix/acme-contact-and-challenge (C1+C2): Add acme_contact field, wire to
  ACME, remove unused challenge_config, add validation rule 19
- fix/remove-health-and-hardcode-https (W5+W14+ADR-022): Remove /health
  from main listener, hardcode X-Forwarded-Proto to https
- fix/config-reload-static-drift (C4): Use ArcSwap<StaticConfig> so reload
  diffs against last config, not startup config
- fix/access-logging (W13): Wire up log_request! macro for every proxied
  request with client_ip, host, method, path, status, upstream, duration_ms

Medium:
- fix/graceful-shutdown (W1+W7): Join HTTPS tasks with timeout instead of
  abort, add shutdown signal to admin socket and eviction task
- fix/connect-timeout (W4): Wire upstream_connect_timeout_secs to enforce
  separate connect timeout

Low/Independent:
- fix/token-bucket-nanosecond (W6): Use as_nanos() instead of as_millis()
- fix/normalize-host-ipv6 (S3): Handle IPv6 bracket notation in normalize_host
- fix/http-port-validation (S1): Validate http_port in range 0 or 1-65535
- fix/integration-test-toml (S10): Fix double-nested listeners.listeners.sites
- fix/logging-test-global-subscriber (W9): Use try_init() to avoid test conflicts
- fix/fragile-error-detection (W3): Add typed error matching or documented string match
- fix/add-code-comments (C3,W8,W10,W11,S9): Document correct-but-non-obvious behaviors
- fix/request-timeout-scope (S8): Document full-request timeout scope
- fix/clean-dead-code (S4+S2): Remove dead_code annotations, add #[non_exhaustive]

Review gate:
- review/post-fix-review: Verify all fixes against architecture spec

tasks/fix/logging-test-global-subscriber.md

@@ -0,0 +1,50 @@
+---
+id: fix/logging-test-global-subscriber
+name: Fix logging test that conflicts with global tracing subscriber
+status: pending
+depends_on: []
+scope: single
+risk: low
+impact: isolated
+level: implementation
+review_findings: [W9]
+---
+
+## Description
+
+The test `init_creates_log_directory_and_file` in `src/logging/mod.rs` calls `init()` which sets a global default tracing subscriber. When tests run in parallel, this conflicts with other tests that may also set a subscriber, causing the test to fail with "a global default trace dispatcher has already been set."
+
+### Changes Required
+
+**`src/logging/mod.rs`**:
+- Change `init()` or the test to use `tracing_subscriber::util::SubscriberInitExt::try_init()` which returns an error if already set rather than panicking
+- Alternatively, use `std::sync::OnceLock` to guard against double-initialization in tests
+- The production code should still use `init()` (which panics on double-init — that's correct behavior for a production binary), but the test should handle the case where a subscriber is already set
+
+### Approach
+
+The cleanest approach is to make `init()` return `Result<()>` and use `try_init()` internally. If initialization fails because a subscriber is already set, return an error rather than panicking. This way:
+- Production code: `init()` is called once at startup; if it fails, that's a real error
+- Tests: Can call `init()` in a test helper and gracefully handle the "already initialized" case
+
+Alternatively, keep `init()` as-is and only change the test to use `try_init()` directly.
+
+## Acceptance Criteria
+
+- [ ] Logging test no longer panics when run in parallel with other tests
+- [ ] Production `init()` behavior is unchanged (sets global subscriber)
+- [ ] All tests pass (including parallel `cargo test`)
+- [ ] `cargo clippy` passes with no warnings
+
+## References
+
+- docs/reviews/002-implementation-review.md — W9 finding
+- src/logging/mod.rs — `init()` function and `init_creates_log_directory_and_file` test
+
+## Notes
+
+> To be filled by implementation agent
+
+## Summary
+
+> To be filled on completion