docs(arch): tighten tls/endpoint/client specs — remove connect/connect_quic, move CallCredentials to core, shed alknet-call TLS deps

Review of the three new crates (alknet-tls, alknet-endpoint, alknet-client)
+ revised core found compile-blocking inconsistencies, stale claims, and
dep-graph contradictions. All resolved:

Critical:
- C1: CallClient::connect / ChannelClient::connect_quic REMOVED (not
  delegated) — keeping them as thin wrappers over AlknetClient::dial_quic
  would make protocol crates depend on alknet-client, contradicting the
  dep graph. Callers compose dial + take-over (2 lines).
- C2: alknet-client feature gates now pull alknet-core/quinn +
  alknet-core/iroh (for Connection::from_quinn_with_alpn / from_iroh).
- C3: rustls-native-certs + webpki-roots added to alknet-tls deps
  (always-present, not feature-gated — CA-verify path is transport-agnostic).

Warning:
- W1: CallCredentials/RemoteIdentity moved to alknet-core (from
  alknet-call) — the dial must not depend on the call protocol; not a
  two-way-door, it determines the dep graph.
- W2: webpki-roots fallback implemented in spec (ADR-088 §5 added) —
  the code claimed a fallback that never existed; now the store is never
  empty, NoRootAnchors unreachable, containerized deployments work.
- W3: EndpointError removed entirely (BindFailed + HandlerNotFound both
  vestigial after ADR-083); shutdown() is now infallible.
- W4: FingerprintPinVerifier moved to alknet-tls (from alknet-call) —
  alknet-call sheds quinn/rustls/rustls-pemfile/rustls-native-certs
  entirely; CallClient becomes a pure protocol crate.

Plus: ClientError removed (only produced by removed connect); S1
(CallCredentials → ClientVerifierContext mapping + auth_token stripped
at TLS boundary documented); amendment notes on ADR-017, ADR-069,
ADR-080, ADR-082, ADR-087, ADR-090; overview crate graph + README index
updated.

29 files, consistency-reviewed.

docs/architecture/decisions/010-alpn-router-and-endpoint.md

@@ -152,7 +152,16 @@ This reframes the connectivity model. The quinn and iroh paths are not distingui
 
 ### Error taxonomy
 
+> **`EndpointError` is removed** per ADR-083 (Amendment 2026-07-15 +
+> the `EndpointError`-removal amendment). `BindFailed` is vestigial
+> (the endpoint takes pre-bound transports); `TlsConfig` is removed
+> (the endpoint takes no TLS config); `HandlerNotFound` is swallowed
+> by `dispatch` (close + log, not an error). `shutdown()` is
+> infallible. The sketch below is the historical shape; it does not
+> survive into `alknet-endpoint`. `HandlerError` is unchanged.
+
 ```rust
+// HISTORICAL — removed per ADR-083. See the note above.
 pub enum EndpointError {
     BindFailed(io::Error),
     TlsConfig(io::Error),
@@ -167,8 +176,11 @@ pub enum HandlerError {
 }
 ```
 
-- `EndpointError`: Problems starting or running the endpoint. Fatal — the endpoint cannot accept connections.
-- `HandlerError`: Problems within a handler's `handle()` method. Non-fatal — the connection is closed, but the endpoint keeps running.
+- ~~`EndpointError`~~: **removed** (ADR-083). The endpoint takes
+  pre-built transports and swallows no-handler matches; `shutdown()` is
+  infallible.
+- `HandlerError`: Problems within a handler's `handle()` method.
+  Non-fatal — the connection is closed, but the endpoint keeps running.
 
 ## Consequences