feat(cli): select transport in config; server MultiServer + client dial handover

- aura-cli config gains [transport] (order + per-transport ports + obfuscate/
  masquerade); server binds all enabled transports via MultiServer, client uses
  dial() with UDP->TCP->QUIC handover. Config examples updated; backward-compatible
  (defaults to udp,tcp,quic). 21 cli tests incl. a real-UDP-transport loopback.
- docs/sing-box.md: integration approach note (process-bridge now; native Go
  outbound for phones, with crypto-library mapping + KAT requirement).
- Normalize rustfmt across the v2 transport files (tcp/dial/udp contract).

Whole workspace: 97 tests pass, clippy -D warnings clean, fmt clean. Deploy flow
(pki init/issue-server/issue-client) validated with the release binary.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

crates/aura-transport/tests/tcp_loopback.rs

@@ -8,8 +8,12 @@ use aura_transport::{TcpClient, TcpOpts, TcpServer};
 /// Mint a fresh CA + server("localhost") + client("client-tcp") and build the proto configs.
 fn make_configs() -> (ServerConfig, ClientConfig) {
     let ca = AuraCa::generate("Aura Test CA").expect("generate CA");
-    let server = ca.issue_server_cert("localhost").expect("issue server cert");
-    let client = ca.issue_client_cert("client-tcp").expect("issue client cert");
+    let server = ca
+        .issue_server_cert("localhost")
+        .expect("issue server cert");
+    let client = ca
+        .issue_client_cert("client-tcp")
+        .expect("issue client cert");
     let ca_pem = ca.ca_cert_pem();
     let scfg = ServerConfig {
         ca_cert_pem: ca_pem.clone(),