docs(arch): ConnectionCredentials decouples dial from call protocol (ADR-091) + migration plan cleanups

ADR-091: ConnectionCredentials — decouple the dial credential bundle
from the call protocol. CallCredentials (call-protocol-level, carries
auth_token) was being used as the dial's credential type, coupling the
dial to the call protocol. The auth_token is a hub-layer identity
correlation mechanism (browsers, alknet/register), not a transport
credential. ConnectionCredentials (transport-level: local_identity +
remote_identity) is the dial's credential bundle; all three dial
signatures unify on &ConnectionCredentials; dial_iroh's node_id
parameter is derived from remote_identity.fingerprint. CallCredentials
stays in alknet-call with auth_token. The shape is validated by the
future dial_ssh pattern (russh's check_server_key + authenticate_publickey
consume the same two dimensions).

Amends ADR-089 §3 (dial signatures) and §5 (move consequence), ADR-087
(input framing). Updates client/tls/call/core crate specs and the
extraction plan's Phase 0/3/4/5.

Migration plan cleanups (findings.md):
- Remove duplicated ordering-rationale bullets (copy-paste artifact)
- TL;DR: six phases -> seven (Phase 0 promoted); four compilable
  intermediate states -> each phase leaves workspace compilable
- Remove inline 'Wait — that's 10, not 8' self-correction; fix
  Category B header to (10 tests)
- Replace contradictory line ranges in Net Phase 5 test impact with
  name-based references
- Decide quinn feature fate: removed (not no-op)
- Note webpki-roots always-present per ADR-088 §5 in Phase 1 dep list

docs/architecture/crates/call/client-and-adapters.md

@@ -246,19 +246,43 @@ attribution, filtered by the calling peer's authorization). See
 
 ### Credential sources for connections
 
-`CallCredentials` (now in `alknet-core`, moved from `alknet-call` per
-ADR-089 §5 so the dial does not depend on the call protocol) carries
-the three credential dimensions (ADR-017 §7). Credentials come from
-`Capabilities` (ADR-014), never from environment variables. The three
-credential dimensions (ADR-017 §7):
+The credential dimensions are split across two layers (ADR-091):
+
+- **`ConnectionCredentials`** (in `alknet-core`, moved from
+  `alknet-call` per ADR-091) — the **transport-level** credential
+  bundle, consumed by the dial (`AlknetClient`). Carries the two
+  transport-identity dimensions: `local_identity` (the local node's
+  `TlsIdentity`) and `remote_identity` (the expected fingerprint). The
+  dial does not depend on the call protocol for this type.
+- **`CallCredentials`** (stays in `alknet-call`) — the
+  **call-protocol** credential bundle. The `auth_token` dimension
+  (ADR-017 §7) is a call-protocol / hub-layer concept: a bearer token
+  correlated to an identity via `IdentityProvider::resolve_from_token`,
+  used for browsers (no raw-key support) and `alknet/register` (no
+  prior peer relationship). It is a per-request field on
+  `call.requested` payloads, not a transport credential.
+
+Credentials come from `Capabilities` (ADR-014), never from environment
+variables. The three credential dimensions (ADR-017 §7):
 
 ```rust
-pub struct CallCredentials {
-    pub tls_identity: Option<TlsIdentity>,      // RFC 7250 raw key or X.509
-    pub auth_token: Option<AuthToken>,           // call-protocol-level token
-    pub remote_identity: Option<RemoteIdentity>, // expected fingerprint/cert (None = CA path, see below)
+// Transport-level (alknet-core, consumed by the dial — ADR-091)
+pub struct ConnectionCredentials {
+    pub local_identity: Option<TlsIdentity>,   // RFC 7250 raw key or X.509
+    pub remote_identity: Option<RemoteIdentity>, // expected fingerprint (None = CA path / fail-closed)
 }
 
+// Call-protocol-level (alknet-call — the auth_token stays here)
+// The auth_token is set per-request on call.requested payloads, not
+// carried by the dial.
+```
+
+`CallCredentials` retains `auth_token` (and may assemble from
+`ConnectionCredentials` + `auth_token` at the take-over site, or the
+caller provides `auth_token` per-request via `call_with_payload`). The
+transport dimensions (`local_identity`, `remote_identity`) moved to
+`ConnectionCredentials` in `alknet-core` per ADR-091.
+
 /// Expected identity of the remote node (ADR-017 §7, extended by
 /// ADR-034 §2). Carries a fingerprint string the assembly layer
 /// derives from `Capabilities` when the local node has a `PeerEntry`