refactor(core,tls,client): align ConnectionCredentials field name with ADR-091 (tls_identity -> local_identity)

ADR-091 decided `ConnectionCredentials.local_identity`; the code implemented
`tls_identity` (tasks/core/connection-credentials.md deferred the rename as
"path of least resistance" during the extraction). The tangle that made the
rename hard no longer exists, so align the code with the decision.

Scope is the `ConnectionCredentials` field + builder only:
- alknet-core/credentials.rs: field, with_local_identity, doc, test
- alknet-tls/client.rs: field access in TlsClientConfig::new, test builders, docs
- alknet-client/dial/quinn.rs: test builder

NOT renamed (distinct concepts sharing the words):
- StaticConfig.tls_identity (server-side static config; ADR-082/027/083)
- TlsIdentity enum type name
- alknet-tls server fn params named tls_identity (&TlsIdentity value)

Also fixes dial_iroh.rs doc comments that claimed the local key is extracted
from creds.local_identity — the key is actually on the pre-built iroh endpoint
(set at with_iroh time); the dial reads only creds.remote_identity and ignores
creds.local_identity (per client/README.md §iroh).

Architecture specs updated to match (call/client-and-adapters.md, tls/README.md,
client/README.md). Historical ADR context describing the old CallCredentials
field stays as-is; tasks/ and docs/research/ are historical artifacts.

Resolves follow-up #2 from the post-extraction spec sync (c6eef73).

docs/architecture/crates/call/client-and-adapters.md

@@ -254,7 +254,7 @@ The credential dimensions are split across two layers (ADR-091, amended
 - **`ConnectionCredentials`** (in `alknet-core`, per ADR-091) — the
   **transport-level** credential bundle, consumed by the dial
   (`AlknetClient`). Carries the two transport-identity dimensions:
-  `tls_identity` (the local node's `TlsIdentity`) and `remote_identity`
+  `local_identity` (the local node's `TlsIdentity`) and `remote_identity`
   (the expected fingerprint). The dial does not depend on the call
   protocol for this type.
 - **`auth_token`** — a **per-request payload field**, not a
@@ -276,7 +276,7 @@ variables. The transport-identity dimensions (ADR-017 §7):
 ```rust
 // Transport-level (alknet-core, consumed by the dial — ADR-091)
 pub struct ConnectionCredentials {
-    pub tls_identity: Option<TlsIdentity>,     // RFC 7250 raw key or X.509
+    pub local_identity: Option<TlsIdentity>,     // RFC 7250 raw key or X.509
     pub remote_identity: Option<RemoteIdentity>, // expected fingerprint (None = CA path / fail-closed)
 }
 
@@ -306,7 +306,7 @@ pub struct RemoteIdentity { pub fingerprint: String }
 ```
 
 There is no call-protocol credential bundle. `CallCredentials` is
-removed. The transport dimensions (`tls_identity`, `remote_identity`)
+removed. The transport dimensions (`local_identity`, `remote_identity`)
 are in `ConnectionCredentials` in `alknet-core` per ADR-091.
 
 - **TLS identity** — the local node's Ed25519 raw key (RFC 7250) or X.509 cert,
@@ -781,7 +781,7 @@ Based on the gap analysis and the downstream unblock chain:
 | Abort cascade for nested calls | [ADR-016](../../decisions/016-abort-cascade-for-nested-calls.md) | Cross-node abort through `from_call` forwarding handler's `parent_request_id` |
 | Operation error schemas | [ADR-023](../../decisions/023-operation-error-schemas.md) | `error_schemas` mirrored by `from_call` from remote op's spec |
 | Streaming handler for subscriptions | [ADR-049](../../decisions/049-streaming-handler-for-subscriptions.md) | `from_call` `Subscription` ops register a `StreamingHandler` (`HandlerKind::Stream`) that calls `CallConnection::subscribe()` and forwards the remote stream; `Query`/`Mutation` stay `HandlerKind::Once` |
-| TLS identity redesign | [ADR-027](../../decisions/027-tls-identity-redesign-acme-rawkey-decoupling.md) | RFC 7250 raw key / X.509 cert dimensions of the local `TlsIdentity` (now carried by `ConnectionCredentials.tls_identity`) |
+| TLS identity redesign | [ADR-027](../../decisions/027-tls-identity-redesign-acme-rawkey-decoupling.md) | RFC 7250 raw key / X.509 cert dimensions of the local `TlsIdentity` (now carried by `ConnectionCredentials.local_identity`) |
 | Outgoing-only X.509 and three peer roles | [ADR-034](../../decisions/034-outgoing-only-x509-and-three-peer-roles.md) | Public X.509 endpoint is not a `PeerEntry` on the client side (no `PeerId`, not in peer graph); client-side verifier by `PeerEntry` presence (CA vs fingerprint pin); hub = mixed-fingerprint `PeerEntry` |
 | HD derivation for encryption keys | [ADR-020](../../decisions/020-hd-derivation-for-encryption-keys.md) | Vault-derived TLS identity material |
 | Vault key model | [ADR-026](../../decisions/026-vault-key-model-hd-derivation.md) | Vault-derived TLS identity material |

docs/architecture/crates/client/README.md

@@ -431,7 +431,7 @@ consumes only `creds.remote_identity` (deriving the remote `NodeId`);
 the local key is not in `ConnectionCredentials` for the iroh path — it
 is on the endpoint. The dial signature is unified — all three dials
 take `&ConnectionCredentials` (ADR-091) — and the iroh dial simply
-ignores the `tls_identity` field (the key is already on the endpoint).
+ignores the `local_identity` field (the key is already on the endpoint).
 The verifier is iroh's `NodeId` match — the remote's `NodeId` (Ed25519
 public key) is verified against the expected `NodeId`, which is
 fingerprint-pinning by another name. An unknown iroh remote fails
@@ -640,7 +640,7 @@ let client = AlknetClient::new()
 
 // 3. Derive credentials from the vault (ADR-014 — no env vars).
 let creds = ConnectionCredentials::new()
-    .with_tls_identity(TlsIdentity::RawKey(local_key))
+    .with_local_identity(TlsIdentity::RawKey(local_key))
     .with_remote_identity(RemoteIdentity {
         fingerprint: hub_fingerprint,  // known peer → fingerprint pin
     });
@@ -674,7 +674,7 @@ All design decisions are documented as ADRs in
 |-----|----------|---------|
 | [089](../../decisions/089-alknetclient-native-dial-seam.md) | AlknetClient — native client dial seam | New crate `alknet-client`; client-side analogue of `AlknetEndpoint`; three dials (QUIC + TCP+TLS via `TlsClientConfig`, iroh via key); resolves OQ-55; `alknet/register` named, wire protocol deferred (§3/§5 amended by ADR-091 — dial takes `ConnectionCredentials`, not `CallCredentials`) |
 | [090](../../decisions/090-client-dial-socks5-proxy-seam.md) | Client-Dial SOCKS5 Proxy Seam | `AlknetClient` gains `with_socks5_proxy`; `dial_quic` routes via UDP ASSOCIATE, `dial_tcp_tls` via CONNECT, `dial_iroh` forces relay-only via an HTTP-to-SOCKS5 bridge; OQ-67 resolved; grounded in the quinn-proxy + iroh-proxy PoCs |
-| [091](../../decisions/091-connectioncredentials-decouple-dial-from-call.md) | `ConnectionCredentials` — decouple dial from call protocol | The dial credential bundle is `ConnectionCredentials` (transport-level: `tls_identity` + `remote_identity`), not `CallCredentials` (call-protocol-level); all three dial signatures unify on `&ConnectionCredentials`; `dial_iroh`'s `node_id` derived from `remote_identity`; `auth_token` is a per-request payload field; `CallCredentials` removed per Am. 2026-07-17 |
+| [091](../../decisions/091-connectioncredentials-decouple-dial-from-call.md) | `ConnectionCredentials` — decouple dial from call protocol | The dial credential bundle is `ConnectionCredentials` (transport-level: `local_identity` + `remote_identity`), not `CallCredentials` (call-protocol-level); all three dial signatures unify on `&ConnectionCredentials`; `dial_iroh`'s `node_id` derived from `remote_identity`; `auth_token` is a per-request payload field; `CallCredentials` removed per Am. 2026-07-17 |
 
 ## Open Questions
 

docs/architecture/crates/tls/README.md

@@ -473,7 +473,7 @@ impl TlsClientConfig {
     /// dial's ALPN. `ConnectionCredentials` (ADR-091, in `alknet-core`)
     /// carries the two dimensions the dial consumes:
     ///
-    /// 1. `tls_identity` — the local node's `TlsIdentity` (RFC 7250
+    /// 1. `local_identity` — the local node's `TlsIdentity` (RFC 7250
     ///    raw key or X.509), presented as the client cert. `None` →
     ///    no client cert (the server gets nothing to fingerprint).
     ///    `SelfSigned` → no client cert (dev-only). `Acme` →