feat(cli): v3.1 multi-hop runtime — circuit client + relay rendezvous

Completes v3.1 multi-hop / onion routing (2 hops: client → entry-relay →
exit-server). Combined with the scaffold commit (6c14c0d), the property
holds: entry-relay knows the client IP + client_id but cannot decrypt the
data; exit knows the destination but sees the relay's IP as source.

- aura-cli::circuit: dial_circuit(&[entry, exit], proto_cfg, udp_opts) →
  CircuitConnection. Connects to entry as a normal UdpClient, sends an
  ExtendBridge control envelope, awaits CircuitReady, then runs a SECOND
  Aura handshake to the exit through a local loopback UDP proxy — the
  forwarder ferries datagrams between that proxy socket and the outer
  relay PacketConnection. The inner handshake therefore authenticates the
  EXIT cert (verified by the integration test asserting
  circuit.peer_id() == "localhost-exit"); the relay never sees the inner
  session keys.
- aura-cli::relay: rendezvous(conn, whitelist) -> Bridged{bridge} |
  Fallback{first_pkt} | Refused. 2-second window after handshake to receive
  ExtendBridge. Whitelist enforced; CircuitFailed on miss. Empty whitelist
  logs a warning and runs open. Timeout / non-control → Fallback so the
  same server can be both relay (for circuit clients) and exit (for direct
  clients) simultaneously.
- aura-cli::client: when [client.circuit] enabled → dial_circuit; falls
  back to normal aura_transport::dial when disabled.
- aura-cli::server: relay rendezvous wired before pool/CRL/router path.
  run_bridge spawns two forwarder tasks (conn↔bridge UDP socket).
- 3 integration tests: end-to-end (with peer_id assertion), whitelist
  rejection, back-compat (relay disabled → Err). 3 unit tests in relay.rs.

Workspace: 253 tests passed (247 baseline + 6 new), clippy -D warnings clean,
fmt clean. No new workspace deps. All 28 tracked tasks (v1 + v2 + v3.1) now
complete.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

config/client.toml.example

@@ -126,3 +126,18 @@ knock_secret_source = "ca_fingerprint"
 enabled = false
 mean_interval_ms = 500
 jitter = 0.5
+
+# v3.1 multi-hop / onion routing: dial through an entry-relay before reaching the exit-server.
+# When `enabled = true`, the client opens an OUTER Aura UDP connection to `hops[0]` (the relay),
+# sends one ExtendBridge envelope describing `hops[1]` (the exit), waits for CircuitReady, and
+# then runs an INNER Aura handshake addressed to the exit through that relay — two AEAD layers
+# per packet, the exit knows the client's CN but not the source IP, the relay knows the source
+# IP but not the destination nor a single plaintext byte. Exactly two hops are required in
+# v3.1; configure the relay-server with [server.relay] enabled = true and
+# allow_extend_to = ["<this client's exit IP:port>"].
+#
+# Omitting the section (or `enabled = false`) keeps the v2 single-hop dial path intact —
+# [client] server_addr / [transport] order rules apply as before.
+# [client.circuit]
+# enabled = true
+# hops = ["198.51.100.5:443", "203.0.113.10:443"]   # [entry_relay, exit_server] — literal IP:port