Make the syslog forwarder's enterprise number configurable (currently the RFC 5612 documentation PEN)

The syslog audit forwarder emits RFC 5424 structured-data frames whose SD-ID is hardcoded to the IANA documentation PEN:

```rust
// crates/sysknife-daemon/src/audit_forward.rs:309
let sd = format!(
"[sysknife@32473 \
seq=\"{}\" ...
```

`32473` is RFC 5612's reserved documentation and test Private Enterprise Number. The code comment above the format string already flags this:

> **PEN 32473 is RFC 5612's documentation/test PEN, it MUST be replaced before production deployment.** RFC 5424 §7.2.2 requires an IANA-assigned Private Enterprise Number on SD-IDs emitted in production frames. [...] Operators running a SIEM under a regulated framework should either patch `SD@32473` to their own PEN at build time or treat this as a known gap (see issue tracker).

The comment points at "the issue tracker", and no such issue exists. This is that issue.

## The problem

`SyslogForwardSection` in `crates/sysknife-core/src/config.rs:207` carries only `host` and `facility`. There is no way to set the PEN short of editing the source and rebuilding. An operator forwarding SysKnife's audit trail into a compliance SIEM ships frames tagged with a documentation PEN, which a strict RFC 5424 parser is entitled to reject and which collides with anyone else using the reserved number.

## Proposed change

Add an optional `enterprise_number` field to `SyslogForwardSection`, default `32473`, and thread it into the SD-ID rather than hardcoding the literal. Reject a value of 0 and anything outside the u32 IANA range at config-parse time, next to the existing `facility` validation.

- `crates/sysknife-core/src/config.rs:207`: the new field and its default.
- `crates/sysknife-daemon/src/audit_forward.rs:309`: build `sysknife@{pen}` from the config value.
- The test sites that assert the literal `sysknife@32473` (`:483`, `:721`, `:722` and the surrounding frame checks) become assertions over the configured value, with one case at the default and one at a custom PEN.

Keep the comment, reworded: the default stays the documentation PEN, so the warning about production use still holds, but an operator now has a config knob instead of a source patch.

## Difficulty

`medium`. One config field, one format string, and the frame is already byte-for-byte tested so a golden vector at a custom PEN pins the behaviour.

## Getting started

[CONTRIBUTING.md](https://github.com/lacs-project/sysknife/blob/main/CONTRIBUTING.md) has the build and test commands. No CLA and no copyright waiver. The project is MIT.

Start in crates/sysknife-core/src/config.rs:207 with SyslogForwardSection and its existing facility validation, then trace the value into crates/sysknife-daemon/src/audit_forward.rs:309. Update the frame checks around lines 483, 721, and 722, preserving the default PEN and adding coverage for a custom PEN. Use the build and test commands in CONTRIBUTING.md; done means validated configuration and frames use the configured enterprise number.

Written by the indexing model from the issue text.