docs(architecture): sync specs to post-extraction state (phases 0-5)

The crate-extraction migration (phases 0-5) is complete in the code;
the specs still carried forward/migration framing ("was welded",
"after the refactor", "currently duplicated", "does not exist yet",
"What moves from X to Y" tables, "Implementation ordering") that
described the migration rather than the resulting state. Updated 10
spec files to describe the current state cleanly.

Spec/code mismatches fixed:
- core/README.md: a stale paragraph said CallCredentials "stays in
  alknet-call" while ADR-091 Am. 2026-07-17 removed it. Now consistent.
- tls/README.md: TlsClientConfig API described a planned
  ClientVerifierContext + for_tcp_tls(&self) + rustls_config(&self);
  the actual code is new(&ConnectionCredentials, alpn) +
  for_quinn(self) + into_rustls_config(self). Updated to match.
- client/README.md, call/client-and-adapters.md: ConnectionCredentials
  field is tls_identity / with_tls_identity in the code, not
  local_identity / with_local_identity. Updated the specs describing
  the current API (ADR-091 body keeps local_identity as the decided
  name).
- client/README.md: dial_iroh description said the local key is
  "extracted from creds.local_identity" — the code uses the pre-built
  iroh endpoint's key (set at with_iroh time) and reads only
  creds.remote_identity for the NodeId. Fixed.
- overview.md: said core has "no quinn/iroh deps" — core keeps
  quinn/iroh for Connection::from_quinn/from_iroh. Fixed.
- call/client-and-adapters.md: a /// doc-comment block and
  pub struct RemoteIdentity were floating outside any code fence
  (orphaned closing backticks). Fixed.
- tls/README.md: TlsError sketch shows the full ADR-088 6-variant
  enum; the code has a simplified 3-variant enum. Added an
  implementation note flagging the divergence; ADR-088 shape kept as
  target.
- call/README.md: review note said "ADR-029 migration pending" (stale
  — migration landed). Updated to reflect phase 5 completion (pure
  protocol crate, no TLS/transport deps, verified against Cargo.toml).

Migration framing removed (present-state descriptions instead):
- tls/README.md: "What moves from" tables -> module-contents tables;
  "Implementation ordering / greenfield" section removed; "after the
  refactor" section -> "What AlknetEndpoint does"; references to
  extraction-source files (alknet-core/src/endpoint.rs,
  alknet-call/src/client/call_client.rs) replaced with current file
  locations (alknet-tls/src/{server,client,pem,signing}.rs).
- endpoint/README.md: "was two things welded" framing removed;
  "after the extraction" section -> "What alknet-core looks like".
- core/endpoint.md: "Historical summary" section removed; clean
  deprecation pointer.
- README.md, overview.md, open-questions.md: dates + present-tense
  cleanup.

docs/architecture/crates/endpoint/README.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-07-15
+last_updated: 2026-07-17
 ---
 
 # alknet-endpoint
@@ -22,24 +22,23 @@ It does not build transports and does not build TLS configs — the
 assembly layer does both (transports from `alknet-tls`'s
 `TlsServerConfig`, per ADR-082).
 
-`alknet-endpoint` is extracted from `alknet-core` (ADR-083 Amendment
-2026-07-15). The extraction is structural pruning, not a refactor: the
-endpoint is a leaf consumer of core's shared types (it imports `auth`,
-`config`, `types`; nothing in core imports from it), depended on by a
-different audience (the assembly layer) than the shared types (every
-handler crate). No handler crate imports `AlknetEndpoint` or
-`HandlerRegistry` — they depend on `alknet-core` for
-`ProtocolHandler`, `Connection`, `AuthContext`, and types only.
-(`EndpointError` is removed — see below.)
+`alknet-endpoint` is a leaf consumer of `alknet-core`'s shared types
+(it imports `auth`, `config`, `types`; nothing in core imports from
+it), depended on by the assembly layer — a different audience than the
+shared types (every handler crate). No handler crate imports
+`AlknetEndpoint` or `HandlerRegistry` — they depend on `alknet-core`
+for `ProtocolHandler`, `Connection`, `AuthContext`, and types only.
+This keeps the heavy transport deps (quinn, iroh, tokio-rustls) out of
+the handler crates' dep closure. (`EndpointError` is removed — see
+below.)
 
 ## Why
 
-`alknet-core` was two things welded: shared types (depended on by every
-handler crate) + the endpoint (depended on by zero handler crates).
-Extracting the endpoint into `alknet-endpoint` lets core shed the heavy
-transport deps (quinn, iroh, rcgen, rustls-acme) and become the
-lightweight types+auth+config crate the handler crates actually want.
-See [ADR-083](../../decisions/083-endpoint-as-accept-loop-runner.md)
+Separating the endpoint from the shared-types crate lets `alknet-core`
+be the lightweight types+auth+config crate that every handler crate
+wants, while the accept-loop runner (which only the assembly layer
+depends on) carries the heavy transport deps. See
+[ADR-083](../../decisions/083-endpoint-as-accept-loop-runner.md)
 §"Amendment 2026-07-15 — crate extraction" for the full rationale,
 including the dependency data and the symmetry with `alknet-client`.
 
@@ -332,15 +331,16 @@ The endpoint takes the pre-built transports; the assembly layer built
 them from `alknet-tls`'s `TlsServerConfig`s. The endpoint does not see
 `alknet-tls` — it sees `quinn::Endpoint` and `TlsAcceptor`.
 
-## What `alknet-core` looks like after the extraction
+## What `alknet-core` looks like
 
-Core loses the endpoint module (~1600 LOC) and 5 heavy deps (`quinn`,
-`iroh`, `rcgen`, `rustls-pemfile`, `rustls-acme`). The remaining surface
-is the lightweight types+auth+config+ownership+store+fingerprint crate.
-See [ADR-083](../../decisions/083-endpoint-as-accept-loop-runner.md)
-§"Amendment 2026-07-15 — crate extraction" §"What `alknet-core` looks
-like after" for the module-level table and the `quinn` feature split
-(`Connection::from_quinn` stays in core; the accept loop moves here).
+Core is the lightweight types+auth+config+ownership+store+fingerprint
+crate (~3200 LOC, no `quinn`/`iroh`/`rcgen`/`rustls-pemfile`/
+`rustls-acme` deps). The endpoint module is not in core; the accept
+loops are here. See [ADR-083](../../decisions/083-endpoint-as-accept-
+loop-runner.md) §"Amendment 2026-07-15 — crate extraction" §"What
+`alknet-core` looks like after" for the module-level table and the
+`quinn` feature split (`Connection::from_quinn` stays in core; the
+accept loop is here).
 
 ## Design Decisions