refactor(core,tls,client): align ConnectionCredentials field name with ADR-091 (tls_identity -> local_identity)

ADR-091 decided `ConnectionCredentials.local_identity`; the code implemented
`tls_identity` (tasks/core/connection-credentials.md deferred the rename as
"path of least resistance" during the extraction). The tangle that made the
rename hard no longer exists, so align the code with the decision.

Scope is the `ConnectionCredentials` field + builder only:
- alknet-core/credentials.rs: field, with_local_identity, doc, test
- alknet-tls/client.rs: field access in TlsClientConfig::new, test builders, docs
- alknet-client/dial/quinn.rs: test builder

NOT renamed (distinct concepts sharing the words):
- StaticConfig.tls_identity (server-side static config; ADR-082/027/083)
- TlsIdentity enum type name
- alknet-tls server fn params named tls_identity (&TlsIdentity value)

Also fixes dial_iroh.rs doc comments that claimed the local key is extracted
from creds.local_identity — the key is actually on the pre-built iroh endpoint
(set at with_iroh time); the dial reads only creds.remote_identity and ignores
creds.local_identity (per client/README.md §iroh).

Architecture specs updated to match (call/client-and-adapters.md, tls/README.md,
client/README.md). Historical ADR context describing the old CallCredentials
field stays as-is; tasks/ and docs/research/ are historical artifacts.

Resolves follow-up #2 from the post-extraction spec sync (c6eef73).

docs/architecture/crates/call/client-and-adapters.md

@@ -254,7 +254,7 @@ The credential dimensions are split across two layers (ADR-091, amended
 - **`ConnectionCredentials`** (in `alknet-core`, per ADR-091) — the
   **transport-level** credential bundle, consumed by the dial
   (`AlknetClient`). Carries the two transport-identity dimensions:
-  `tls_identity` (the local node's `TlsIdentity`) and `remote_identity`
+  `local_identity` (the local node's `TlsIdentity`) and `remote_identity`
   (the expected fingerprint). The dial does not depend on the call
   protocol for this type.
 - **`auth_token`** — a **per-request payload field**, not a
@@ -276,7 +276,7 @@ variables. The transport-identity dimensions (ADR-017 §7):
 ```rust
 // Transport-level (alknet-core, consumed by the dial — ADR-091)
 pub struct ConnectionCredentials {
-    pub tls_identity: Option<TlsIdentity>,     // RFC 7250 raw key or X.509
+    pub local_identity: Option<TlsIdentity>,     // RFC 7250 raw key or X.509
     pub remote_identity: Option<RemoteIdentity>, // expected fingerprint (None = CA path / fail-closed)
 }
 
@@ -306,7 +306,7 @@ pub struct RemoteIdentity { pub fingerprint: String }
 ```
 
 There is no call-protocol credential bundle. `CallCredentials` is
-removed. The transport dimensions (`tls_identity`, `remote_identity`)
+removed. The transport dimensions (`local_identity`, `remote_identity`)
 are in `ConnectionCredentials` in `alknet-core` per ADR-091.
 
 - **TLS identity** — the local node's Ed25519 raw key (RFC 7250) or X.509 cert,
@@ -781,7 +781,7 @@ Based on the gap analysis and the downstream unblock chain:
 | Abort cascade for nested calls | [ADR-016](../../decisions/016-abort-cascade-for-nested-calls.md) | Cross-node abort through `from_call` forwarding handler's `parent_request_id` |
 | Operation error schemas | [ADR-023](../../decisions/023-operation-error-schemas.md) | `error_schemas` mirrored by `from_call` from remote op's spec |
 | Streaming handler for subscriptions | [ADR-049](../../decisions/049-streaming-handler-for-subscriptions.md) | `from_call` `Subscription` ops register a `StreamingHandler` (`HandlerKind::Stream`) that calls `CallConnection::subscribe()` and forwards the remote stream; `Query`/`Mutation` stay `HandlerKind::Once` |
-| TLS identity redesign | [ADR-027](../../decisions/027-tls-identity-redesign-acme-rawkey-decoupling.md) | RFC 7250 raw key / X.509 cert dimensions of the local `TlsIdentity` (now carried by `ConnectionCredentials.tls_identity`) |
+| TLS identity redesign | [ADR-027](../../decisions/027-tls-identity-redesign-acme-rawkey-decoupling.md) | RFC 7250 raw key / X.509 cert dimensions of the local `TlsIdentity` (now carried by `ConnectionCredentials.local_identity`) |
 | Outgoing-only X.509 and three peer roles | [ADR-034](../../decisions/034-outgoing-only-x509-and-three-peer-roles.md) | Public X.509 endpoint is not a `PeerEntry` on the client side (no `PeerId`, not in peer graph); client-side verifier by `PeerEntry` presence (CA vs fingerprint pin); hub = mixed-fingerprint `PeerEntry` |
 | HD derivation for encryption keys | [ADR-020](../../decisions/020-hd-derivation-for-encryption-keys.md) | Vault-derived TLS identity material |
 | Vault key model | [ADR-026](../../decisions/026-vault-key-model-hd-derivation.md) | Vault-derived TLS identity material |