Implement pwr-server storage backend, connection handler, and TLS listener

Add the three core server modules that together form the NAS-side daemon.
The storage module (storage.rs) manages an on-disk project registry as a
JSON index file mapping UUIDs to StoredProject entries containing name,
size, file count, encryption flag, and timestamps. The registry is
persisted atomically using a write-to-temp-then-rename pattern. Per-project
directories under the configured storage base path hold data.enc (the
encrypted archive blob) and meta.toml (per-project metadata). Methods
provide CRUD operations on the registry, streaming archive read/write
through buffered I/O, storage limit enforcement against the configured
max_project_size_gb, and filesystem directory management. Five tests verify
create-and-list, duplicate rejection, remove, archive write-read round-trip,
and registry persistence across re-opens.

The handler module (handler.rs) implements a per-connection state machine
with five states: AwaitingHandshake, Authenticated, Archiving, Restoring,
and Closed. The dispatch function routes decoded frames by state and
message type. The handshake handler validates the client’s HMAC-SHA256
proof in constant time using ring::constant_time::verify_slices_are_equal,
then generates a server nonce and server proof for mutual authentication.
Archive start creates a project entry after checking the storage limit,
archive finish updates the final size or rolls back on failure. Restore
start looks up the project and verifies the archive file exists. Status
queries support both single-UUID lookup and full listing. Storage is shared
across connections via Arc<RwLock> with per-operation
read or write locking.

The listener module (listener.rs) loads PEM-encoded TLS certificates via
rustls-pemfile, builds a rustls ServerConfig with TLS 1.3 and the
application-level protocol negotiation tag “pwr/1”, binds a std::net
TcpListener, and spawns each accepted connection on a dedicated OS thread
with a rustls::StreamOwned wrapping the TCP stream for TLS encryption.