feat(proto,cli): v3.1 multi-hop scaffold — control kinds + config sections

Foundation for v3.1 onion routing (client → entry-relay → exit-server).
The relay/circuit runtime is implemented in a follow-up commit; this
scaffold lands the wire-level control extensions and the config schema:

- aura-proto: ControlKind gains ExtendBridge (client→relay), CircuitReady
  (relay→client), CircuitFailed (relay→client, with utf-8 reason); helpers
  encode_extend_bridge / decode_extend_bridge (1-byte family + 4/16 addr
  bytes + u16 port). Integration test in tests/control_extend.rs covers
  IPv4/IPv6 roundtrip + full magic-envelope wrap.
- aura-cli config: [server.relay] {enabled, allow_extend_to} +
  [client.circuit] {enabled, hops} sections; relay_whitelist() helper
  parses IP:port literals. All new fields serde-default, back-compat.
- crl_push.rs touched only to leave the new ControlKinds passing through
  the existing magic-envelope dispatcher unchanged.

Workspace: 247 tests passed (+12), clippy/fmt clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

crates/aura-cli/src/crl_push.rs

@@ -224,6 +224,16 @@ impl AcceptPushedCrlConn {
             ControlKind::CrlAck => {
                 tracing::debug!("server CRL ack received (unexpected — client does not push CRLs)");
             }
+            // v3.1 circuit-setup envelopes (ExtendBridge / CircuitReady / CircuitFailed) are only
+            // meaningful during multi-hop dial (see [`crate::circuit`]). By the time this wrapper
+            // sees a connection the circuit (if any) is already established, so any late envelopes
+            // are a no-op here.
+            ControlKind::ExtendBridge | ControlKind::CircuitReady | ControlKind::CircuitFailed => {
+                tracing::debug!(
+                    kind = ?kind,
+                    "unexpected circuit-setup control envelope on established connection; ignoring"
+                );
+            }
             ControlKind::Unknown(b) => {
                 tracing::debug!(kind = b, "unknown control envelope kind; ignoring");
             }