feat(P02): HCL config file parsing — internal/config package (REQ-054)

New internal/config package: Config struct (HCL tags), Load(paths...),
MergeOverrides(flags, env) with flag>env>file>default precedence (D-039).
No package-level state (AD-023). --config persistent flag on root command;
daemon uses cfg.ListenAddr when flag at default. 11 config tests + 2 cli tests.

---ci---
project: orca
phase: 2
milestone: v0.7
status: verify
requirements:
  covered: [REQ-054]
  partial: []
---/ci---

internal/cli/root_test.go

@@ -1,8 +1,11 @@
 package cli
 
 import (
+	"os"
 	"strings"
 	"testing"
+
+	"git.cloudinit.dev/coreci/orca/internal/config"
 )
 
 func TestVersionCommandExists(t *testing.T) {
@@ -65,3 +68,47 @@ func TestRootHelpMentionsKeyPillars(t *testing.T) {
 		}
 	}
 }
+
+func TestConfigFlagRegistered(t *testing.T) {
+	f := rootCmd.PersistentFlags().Lookup("config")
+	if f == nil {
+		t.Fatal("--config persistent flag not registered")
+	}
+	if f.DefValue != "" {
+		t.Errorf("--config default = %q, want empty", f.DefValue)
+	}
+}
+
+func TestConfigFlagLoadsFile(t *testing.T) {
+	dir := t.TempDir()
+	cfgPath := dir + "/config.hcl"
+	cfgContent := `db_path          = "` + dir + `/test.db"
+listen_addr      = "127.0.0.1:9999"
+ca_path          = "` + dir + `/ca.crt"
+server_cert_path = "` + dir + `/server.crt"
+server_key_path  = "` + dir + `/server.key"
+
+node_capacity {
+  cpu       = 4
+  memory_mb = 8192
+}
+`
+	if err := os.WriteFile(cfgPath, []byte(cfgContent), 0o644); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	old := configPath
+	configPath = cfgPath
+	defer func() { configPath = old }()
+
+	cfg, err := config.Load(cfgPath)
+	if err != nil {
+		t.Fatalf("load config: %v", err)
+	}
+	if cfg.ListenAddr != "127.0.0.1:9999" {
+		t.Errorf("listen_addr = %q, want 127.0.0.1:9999", cfg.ListenAddr)
+	}
+	if cfg.NodeCapacity == nil || cfg.NodeCapacity.CPU != 4 {
+		t.Errorf("node_capacity.cpu not parsed, got %+v", cfg.NodeCapacity)
+	}
+}