refactor!: rebrand wraith to alknet

Rename all crates, CLI commands, constants, type names, doc comments,
and documentation from wraith to alknet. Includes wire-protocol changes:
ALPN wraith-ssh -> alknet-ssh, reserved destination prefix wraith- ->
alknet-, SSH auth username wraith -> alknet.

tasks/napi/connect-function.md

@@ -13,23 +13,23 @@ level: implementation
 
 ## Description
 
-Implement the NAPI `connect()` function per ADR-007. This is fundamentally different from CLI `wraith connect`:
+Implement the NAPI `connect()` function per ADR-007. This is fundamentally different from CLI `alknet connect`:
 
 - **NAPI `connect()`**: Opens a single SSH channel and returns it as a Node.js `Duplex` stream. No SOCKS5 server, no port forwarding. The caller reads and writes bytes directly.
-- **CLI `wraith connect`**: Full SSH client session with SOCKS5 server and port forwarding.
+- **CLI `alknet connect`**: Full SSH client session with SOCKS5 server and port forwarding.
 
-The function accepts `WraithConnectOptions` and returns `Promise<Duplex>`. The NAPI layer handles transport selection, SSH authentication, and channel setup, then hands the caller a stream.
+The function accepts `AlknetConnectOptions` and returns `Promise<Duplex>`. The NAPI layer handles transport selection, SSH authentication, and channel setup, then hands the caller a stream.
 
 ## Acceptance Criteria
 
-- [ ] `#[napi]` function `connect(options: WraithConnectOptions) -> Result<DuplexStream>` in `crates/wraith-napi/src/connect.rs`
-- [ ] `WraithConnectOptions` struct with napi fields: `server`, `peer`, `transport`, `identity`, `tlsServerName`, `insecure`, `irohRelay`, `proxy`
+- [ ] `#[napi]` function `connect(options: AlknetConnectOptions) -> Result<DuplexStream>` in `crates/alknet-napi/src/connect.rs`
+- [ ] `AlknetConnectOptions` struct with napi fields: `server`, `peer`, `transport`, `identity`, `tlsServerName`, `insecure`, `irohRelay`, `proxy`
 - [ ] Transport creation from options (tcp, tls, iroh) — same logic as CLI but programmatic
 - [ ] SSH client connection: create transport stream, authenticate, open single `direct_tcpip` channel
 - [ ] Channel returned as `napi::DuplexStream` for JavaScript consumption
 - [ ] Key material: `identity` field accepts file path (string) or `Buffer` (in-memory data) per ADR-011
 - [ ] Error marshalling: Rust errors become JavaScript exceptions with descriptive messages
-- [ ] TypeScript type: `(options: WraithConnectOptions) => Promise<Duplex>`
+- [ ] TypeScript type: `(options: AlknetConnectOptions) => Promise<Duplex>`
 - [ ] Integration test from JS: connect to a test server, write/receive bytes through stream
 
 ## References

tasks/napi/project-setup.md

@@ -1,6 +1,6 @@
 ---
 id: napi/project-setup
-name: Set up wraith-napi project with napi-rs build tooling and TypeScript types
+name: Set up alknet-napi project with napi-rs build tooling and TypeScript types
 status: pending
 depends_on:
   - setup/project-init
@@ -12,7 +12,7 @@ level: implementation
 
 ## Description
 
-Set up the napi-rs project for the `@alkdev/wraith` Node.js native addon. This includes the napi-rs build configuration, TypeScript type definitions, and the package structure.
+Set up the napi-rs project for the `@alkdev/alknet` Node.js native addon. This includes the napi-rs build configuration, TypeScript type definitions, and the package structure.
 
 Per ADR-015 and ADR-016: napi-rs is the FFI bridge, and the wrapper exposes `connect()` and `serve()` functions. The NAPI layer is transport-agnostic — it doesn't know about pubsub's `EventEnvelope`.
 
@@ -20,11 +20,11 @@ The Cargo.toml skeleton was created in setup/project-init. This task configures
 
 ## Acceptance Criteria
 
-- [ ] `crates/wraith-napi/` has `Cargo.toml` with `crate-type = ["cdylib"]`, `napi` and `napi-derive` dependencies
-- [ ] `crates/wraith-napi/src/lib.rs` with napi module registration
-- [ ] `packages/wraith-napi/` directory (or similar) with `package.json` named `@alkdev/wraith`
-- [ ] `packages/wraith-napi/tsconfig.json` for TypeScript type generation
-- [ ] TypeScript type definitions for `WraithConnectOptions`, `WraithServeOptions`, `WraithServer`, `ConnectionInfo` matching napi-and-pubsub.md interfaces
+- [ ] `crates/alknet-napi/` has `Cargo.toml` with `crate-type = ["cdylib"]`, `napi` and `napi-derive` dependencies
+- [ ] `crates/alknet-napi/src/lib.rs` with napi module registration
+- [ ] `packages/alknet-napi/` directory (or similar) with `package.json` named `@alkdev/alknet`
+- [ ] `packages/alknet-napi/tsconfig.json` for TypeScript type generation
+- [ ] TypeScript type definitions for `AlknetConnectOptions`, `AlknetServeOptions`, `AlknetServer`, `ConnectionInfo` matching napi-and-pubsub.md interfaces
 - [ ] `napi.config.js` or `NapiRs.config` with correct cargo path, module name
 - [ ] Build command: `npm run build` builds the native addon
 - [ ] Feature flags: `iroh` feature optional; base package includes tcp + tls

tasks/napi/serve-function.md

@@ -13,15 +13,15 @@ level: implementation
 
 ## Description
 
-Implement the NAPI `serve()` function per ADR-016. Returns a `WraithServer` object with a `close()` method and `onConnection` event emitter. Each incoming SSH connection produces a `Duplex` stream.
+Implement the NAPI `serve()` function per ADR-016. Returns a `AlknetServer` object with a `close()` method and `onConnection` event emitter. Each incoming SSH connection produces a `Duplex` stream.
 
-The function accepts `WraithServeOptions` and returns `Promise<WraithServer>`. The NAPI layer handles transport binding, SSH server setup, and connection handling.
+The function accepts `AlknetServeOptions` and returns `Promise<AlknetServer>`. The NAPI layer handles transport binding, SSH server setup, and connection handling.
 
 ## Acceptance Criteria
 
-- [x] `#[napi]` function `serve(options: WraithServeOptions) -> Result<WraithServer>` in `crates/wraith-napi/src/serve.rs`
-- [x] `WraithServeOptions` struct with napi fields: `transport`, `hostKey`, `authorizedKeys`, `certAuthority`, `tlsCert`, `tlsKey`, `acmeDomain`, `listen`, `irohRelay`
-- [x] `WraithServer` napi class with `close() -> Promise<void>` and `onConnection(callback)` event registration
+- [x] `#[napi]` function `serve(options: AlknetServeOptions) -> Result<AlknetServer>` in `crates/alknet-napi/src/serve.rs`
+- [x] `AlknetServeOptions` struct with napi fields: `transport`, `hostKey`, `authorizedKeys`, `certAuthority`, `tlsCert`, `tlsKey`, `acmeDomain`, `listen`, `irohRelay`
+- [x] `AlknetServer` napi class with `close() -> Promise<void>` and `onConnection(callback)` event registration
 - [x] Each incoming connection produces a `Duplex` stream via the `onConnection` callback
 - [x] `ConnectionInfo` struct passed with each connection: `remoteAddr`, `transportKind`
 - [x] Key material: `hostKey`, `authorizedKeys` accept file path (string) or `Buffer` (in-memory)
@@ -32,14 +32,14 @@ The function accepts `WraithServeOptions` and returns `Promise<WraithServer>`. T
 
 ## References
 
-- docs/architecture/napi-and-pubsub.md — NAPI serve() spec, WraithServer interface
+- docs/architecture/napi-and-pubsub.md — NAPI serve() spec, AlknetServer interface
 - docs/architecture/decisions/016-napi-expose-connect-and-serve.md — both connect() and serve()
 - docs/architecture/server.md — server configuration
 
 ## Notes
 
-TCP transport fully implemented. TLS/iroh transports return helpful "not yet supported" errors. WraithServerStream provides read/write/close. ConnectionInfo includes remoteAddr and transportKind.
+TCP transport fully implemented. TLS/iroh transports return helpful "not yet supported" errors. AlknetServerStream provides read/write/close. ConnectionInfo includes remoteAddr and transportKind.
 
 ## Summary
 
-Implemented NAPI serve() in crates/wraith-napi/src/serve.rs: WraithServeOptions, WraithServer with close()/onConnection(), WraithServerStream (Duplex read/write/close), ConnectionInfo. TCP transport works end-to-end. 241 tests pass, clippy clean.
+Implemented NAPI serve() in crates/alknet-napi/src/serve.rs: AlknetServeOptions, AlknetServer with close()/onConnection(), AlknetServerStream (Duplex read/write/close), ConnectionInfo. TCP transport works end-to-end. 241 tests pass, clippy clean.