fix: resolve review #004 findings W1-W4 + close review gate

W1 (call/protocol/abort-cascade-wiring): wire AbortCascade into
CallAdapter handle_stream for EVENT_ABORTED. Cascades with
AbortPolicy::AbortDependents, aborts root, no descendant frames on
wire (ADR-016 Decision 2). Two integration tests added.

W2 (core/endpoint-client-fingerprint): extract TLS client cert
fingerprint in dispatch_quinn (SHA256:<hex> of leaf cert DER via
peer_identity) and dispatch_iroh (ed25519:<hex> of peer NodeId).
Fingerprint format documented in auth.md. Server config change
(with_no_client_auth → request-but-don't-require) deferred to new
follow-up task core/endpoint-request-client-cert.

W3 (vault/mnemonic-debug-redaction): replace Mnemonic derive(Debug)
with manual redacting impl (phrase: "[REDACTED]"). Seed confirmed
no Debug impl. Redaction test added.

W4 (core/auth-apikey-resources): Option B — drop entry.resources from
spec. External identities (token/fingerprint) grant scopes only;
resource-scoped ACLs are composition-internal (ADR-015/022). auth.md
corrected + limitation documented. Two tests confirm empty resources.

review-post-impl-fixes: all 4 verified, workspace green (326 tests,
0 failures, 0 clippy warnings). Review #004 status → resolved.

Graph: 34 tasks, 12 gens.

crates/alknet-vault/src/mnemonic.rs

@@ -32,12 +32,19 @@ impl From<Language> for bip39::Language {
 ///
 /// Wraps the `bip39` crate's `Mnemonic` type and provides seed derivation.
 /// The internal phrase is zeroized on drop.
-#[derive(Debug)]
 pub struct Mnemonic {
     inner: Bip39Mnemonic,
     phrase: String,
 }
 
+impl std::fmt::Debug for Mnemonic {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("Mnemonic")
+            .field("phrase", &"[REDACTED]")
+            .finish()
+    }
+}
+
 impl Mnemonic {
     /// Generate a new random mnemonic with the given word count.
     ///
@@ -163,4 +170,20 @@ mod tests {
         assert_eq!(seed.len(), 64);
         assert!(!seed.is_empty());
     }
+
+    #[test]
+    fn test_mnemonic_debug_redacts_phrase() {
+        let mnemonic = Mnemonic::generate(24).unwrap();
+        let debug_output = format!("{:?}", mnemonic);
+        assert!(
+            debug_output.contains("[REDACTED]"),
+            "Debug must show [REDACTED] for phrase, got: {debug_output}"
+        );
+        for word in mnemonic.phrase().split_whitespace() {
+            assert!(
+                !debug_output.contains(word),
+                "Debug must not leak phrase word '{word}', got: {debug_output}"
+            );
+        }
+    }
 }