docs(arch): ADR-035 — concrete persistence adapter shapes, resolve OQ-36

Commits the concrete adapter shape deferred by ADR-033: read-sync /
write-async split with honker NOTIFY/LISTEN for no-restart cache
invalidation, against SQLite, in a separate alknet-store-sqlite crate.

Two constraints drive the design: (1) the hot-path read trait
(IdentityProvider::resolve_from_fingerprint, CredentialStore::get) is
sync — called in the accept loop, no .await — so a SQLite-backed
adapter must cache in memory and serve sync reads from the cache; (2)
auth changes must take effect without a restart (an early issue the
project already fixed for ConfigIdentityProvider via ArcSwap config
reload). honker's SQLite NOTIFY/LISTEN (single-digit-ms wake, no
polling) is the cache-invalidation mechanism that makes both hold:
write commits to SQLite + emits NOTIFY, the running process's LISTEN
wakes, the in-memory index reloads and atomically swaps, the next
read sees the new state. Same ArcSwap-reload pattern as config,
generalized from 'config file is source of truth' to 'SQLite is
source of truth, honker signals when it changed.'

New async IdentityStore write trait (put_peer / update_peer /
remove_peer) extends the sync IdentityProvider read trait for peer
mutations. ConfigIdentityProvider does NOT implement it (config
reload is its write path — a posture enforced by the absence of a
backend, not a type-system constraint); SqliteIdentityProvider
implements both. CredentialStore::put/delete refined to async (within
ADR-031's one-way door — the contract was get/put/delete keyed by
provider persisting EncryptedData never decrypting; sync-vs-async was
unspecified). CredentialStoreError renamed to shared StoreError
covering both traits.

alknet-store-sqlite is one crate implementing both IdentityStore and
CredentialStore with shared SQLite connection + honker LISTEN infra
(splitting later is a two-way door). Schema shape committed (one row
per PeerEntry with JSON columns for fingerprints/scopes/resources;
one row per EncryptedData blob keyed by provider); exact DDL is an
implementation-detail two-way door in the adapter crate. The keypal
adapter-factory pattern is intentionally not ported to Rust (runtime
column-mapping is a TS affordance; in Rust each adapter is a concrete
type, cross-cutting concerns are a shared helper module).

Amends ADR-031 (put/delete async refinement, StoreError rename),
ADR-033 (concrete adapter shape now specified, two-crate framing
collapsed to one), ADR-034 (OQ-36 now resolved), auth.md (IdentityStore
section, cache-invalidation summary, OQ-36 reference), config.md (two
write paths note), and the OQ-36/OQ-34 entries in open-questions.md.
Review fixed 4 criticals (error-type name divergence, duplicate
IdentityProvider sketch, upsert/Duplicate ambiguity, 'shape unchanged'
contradiction), 7 warnings, 5 suggestions.

docs/architecture/decisions/034-outgoing-only-x509-and-three-peer-roles.md

@@ -368,7 +368,9 @@ It is noted here only to confirm it does not reopen OQ-37.
   quinn/iroh); the `SHA256:<hex>` X.509 fingerprint format
 - [ADR-033](033-storage-boundary-and-repo-adapter-pattern.md) — the
   repo/adapter pattern that an on-chain `IdentityProvider` adapter
-  follows; OQ-36 (concrete adapter shapes deferred for exploration)
+  follows; [ADR-035](035-concrete-persistence-adapter-shapes.md) commits
+  the concrete SQLite adapter shape (the on-chain adapter would follow
+  the same trait + separate-crate pattern)
 - [ADR-017](017-call-protocol-client-and-adapter-contract.md) §7 —
   `CallCredentials.remote_identity` (ADR-017 specified "expected
   fingerprint or cert"; this ADR §2 extends its semantics so that
@@ -382,9 +384,10 @@ It is noted here only to confirm it does not reopen OQ-37.
   that selects the verifier
 - OQ-10 (deferred) — git adapter scope; the on-chain / gossip-synced
   git-hosting hub use case in §6 is downstream of the git crate
-- OQ-36 (open, deferred for exploration) — concrete persistence adapter
-  shapes; the on-chain `IdentityProvider` adapter in §6 follows this
-  pattern
+- OQ-36 (resolved by ADR-035) — concrete persistence adapter shapes;
+  the on-chain `IdentityProvider` adapter in §6 follows the same
+  repo/adapter pattern (trait in core, adapter additive in a separate
+  crate)
 - `docs/research/alknet-http/phase-0-findings.md` — DH-2 (h3 /
   WebTransport deferred past v1); the WebTransport-relay-as-proxy
   feature noted in this ADR's §5 belongs in that deferral bucket