refactor(core,tls,client): align ConnectionCredentials field name with ADR-091 (tls_identity -> local_identity)

ADR-091 decided `ConnectionCredentials.local_identity`; the code implemented
`tls_identity` (tasks/core/connection-credentials.md deferred the rename as
"path of least resistance" during the extraction). The tangle that made the
rename hard no longer exists, so align the code with the decision.

Scope is the `ConnectionCredentials` field + builder only:
- alknet-core/credentials.rs: field, with_local_identity, doc, test
- alknet-tls/client.rs: field access in TlsClientConfig::new, test builders, docs
- alknet-client/dial/quinn.rs: test builder

NOT renamed (distinct concepts sharing the words):
- StaticConfig.tls_identity (server-side static config; ADR-082/027/083)
- TlsIdentity enum type name
- alknet-tls server fn params named tls_identity (&TlsIdentity value)

Also fixes dial_iroh.rs doc comments that claimed the local key is extracted
from creds.local_identity — the key is actually on the pre-built iroh endpoint
(set at with_iroh time); the dial reads only creds.remote_identity and ignores
creds.local_identity (per client/README.md §iroh).

Architecture specs updated to match (call/client-and-adapters.md, tls/README.md,
client/README.md). Historical ADR context describing the old CallCredentials
field stays as-is; tasks/ and docs/research/ are historical artifacts.

Resolves follow-up #2 from the post-extraction spec sync (c6eef73).

crates/alknet-client/src/dial/iroh.rs

@@ -2,9 +2,12 @@
 //!
 //! Feature-gated on `iroh`. The iroh path does NOT use `TlsClientConfig` —
 //! iroh has its own TLS (shares the `Ed25519SecretKey`, not the rustls config
-//! — ADR-087 §3, ADR-089 §3). The local key is extracted from
-//! `creds.local_identity`; the remote `EndpointId` is derived from
-//! `creds.remote_identity.fingerprint`.
+//! — ADR-087 §3, ADR-089 §3). The local key is set on the pre-built iroh
+//! endpoint at `with_iroh` time (the assembly layer reads it from
+//! `StaticConfig` and feeds it to `iroh::Endpoint::builder().secret_key()`);
+//! the dial consumes only `creds.remote_identity` (deriving the remote
+//! `EndpointId` from `creds.remote_identity.fingerprint`) and ignores
+//! `creds.local_identity`.
 
 use alknet_core::credentials::ConnectionCredentials;
 use alknet_core::types::Connection;
@@ -16,8 +19,11 @@ impl AlknetClient {
     /// Iroh dial. Dials on `alpn` via the iroh endpoint. The iroh path
     /// does NOT use `TlsClientConfig` — iroh has its own TLS (shares the
     /// `Ed25519SecretKey`, not the rustls config — ADR-087 §3, ADR-089
-    /// §3). The local key is extracted from `creds.local_identity`; the
-    /// remote `EndpointId` is derived from `creds.remote_identity.fingerprint`
+    /// §3). The local key is on the pre-built iroh endpoint (set at
+    /// `with_iroh` time); the dial consumes only
+    /// `creds.remote_identity` and ignores `creds.local_identity`.
+    /// The remote `EndpointId` is derived from
+    /// `creds.remote_identity.fingerprint`
     /// (`ed25519:<hex>` → `EndpointId::from_bytes`). The verifier is iroh's
     /// `EndpointId` match (fingerprint pin by another name — ADR-034 §3).
     /// An unknown iroh remote fails closed (no CA). Feature-gated on

crates/alknet-client/src/dial/quinn.rs

@@ -100,7 +100,7 @@ mod tests {
     #[tokio::test]
     async fn dial_quic_tls_config_error_on_acme_identity() {
         use alknet_core::config::{AcmeDirectory, TlsIdentity};
-        let creds = ConnectionCredentials::new().with_tls_identity(TlsIdentity::Acme {
+        let creds = ConnectionCredentials::new().with_local_identity(TlsIdentity::Acme {
             domains: vec!["example.com".into()],
             directory: AcmeDirectory::Staging,
             cache_dir: std::path::PathBuf::from("/tmp"),