Initialize `roxyd` binary entrypoint and QUIC/mTLS configuration skeleton

[sae-bom]

Background

This issue is the first step of introducing the newroxyd path based on the
Manager <-> roxyd design discussed in #519

Scope

In scope

• Adding a new roxyd binary entrypoint inside the existing crate
• Minimal main function setup (config loading, tracing, async runtime bootstrap)
• Defining configuration structures for QUIC/mTLS connectivity
• Documentation updates needed to explain coexistence with the legacy path

Out of scope

• Implementing review-protocol request handling
• Porting or modifying any existing legacy logic
• Introducing per-node identity (AgentInfo) fields
• Adding feature flags unless they become strictly unavoidable during implementation

Tasks

1. Add a new binary target inside the existing crate

• Add a new binary entrypoint (e.g. src/bin/roxyd.rs)
  • Note: Only if it proves to be strictly necessary during implementation, introduce a feature flag that allows selecting between the legacy implementation and the new roxyd implementation.
• Define a minimal main that:
  • Parse and load CLI args and/or config path.
  • Initialize tracing using the existing logging infrastructure.
  • Start the main async runtime (e.g. via #[tokio::main]).
• Add a short README section that explains:
  • This is a new implementation path that coexists with the legacy one.
  • Existing code must not be removed while legacy mode is still in use.
  • Current limitations (skeleton only; no real handlers yet).

2. Define configuration for the QUIC/mTLS connection

• Add config fields for QUIC/mTLS connection to Manager
  • QUIC endpoint / Manager address.
  • mTLS / certificate paths (or references).
• Ensure the new configuration fields are:
  • Clearly documented (inline comments or README).
  • Non-invasive to the legacy path (legacy execution must not require these fields).

Acceptance Criteria

• A new roxyd binary target exists and builds successfully within the existing crate.
• The roxyd binary has a minimal but complete main:
  • config loading
  • tracing initialization
  • async runtime bootstrap
• QUIC/mTLS-related configuration structures are defined and documented, without affecting the legacy path.
• No review-protocol logic, request routing, or handler implementations are added.
• No legacy code is removed or behaviorally changed.
• CI passes with:
  • legacy-only builds
  • the new roxyd binary present but inactive beyond scaffolding.