docs(architecture): fix OQ-05 — multi-connectivity endpoint, not multi-transport

Correct the conflation of quinn/TLS/iroh as interchangeable transports.
They are complementary connectivity modes serving different deployment
contexts: quinn (public IP + TLS), iroh (NAT traversal via relay), TCP
(handler-specific, not core). Clarify that TLS cert = network identity,
not auth identity. Map stealth mode to HTTP handler on standard ALPNs
instead of byte-peeking. Resolve OQ-05 as one-way door. SendStream/
RecvStream now use internal enum dispatch for both quinn and iroh
streams.

docs/architecture/open-questions.md

@@ -53,14 +53,14 @@ Door type classifications follow ADR-009:
 
 ## Theme: Transport and Endpoint
 
-### OQ-05: Multi-Transport Endpoint
+### OQ-05: Multi-Connectivity Endpoint
 
 - **Origin**: [overview.md](overview.md)
-- **Status**: open
-- **Door type**: Two-way
-- **Priority**: low
-- **Resolution**: Start with quinn (QUIC over UDP). `AlknetEndpoint` uses `quinn::Endpoint` directly. The endpoint can be made transport-agnostic later by abstracting the connection accept loop behind a trait. iroh connectivity produces QUIC connections that can feed into the same ALPN router. `SendStream`/`RecvStream` are concrete wrappers over quinn types — can become enum dispatch if multi-transport is needed. See ADR-010.
-- **Cross-references**: ADR-001, ADR-010, [core-types.md](crates/core/core-types.md)
+- **Status**: resolved
+- **Door type**: One-way
+- **Priority**: high
+- **Resolution**: `AlknetEndpoint` supports both `quinn::Endpoint` (public QUIC+TLS) and `iroh::Endpoint` (P2P relay-assisted) simultaneously, both optional and feature-gated. Both produce QUIC connections that dispatch through the same `HandlerRegistry` by ALPN string. These are not interchangeable transports — they serve fundamentally different deployment contexts (public IP vs NAT traversal). TCP is not an endpoint concern — bare TCP SSH is handled by the SSH handler directly. See ADR-010.
+- **Cross-references**: ADR-001, ADR-010, [endpoint.md](crates/core/endpoint.md)
 
 ### OQ-06: Server-Side ALPN vs Client-Side ALPN