docs: clarify phase boundaries — Phase 1 vs downstream concerns

The architecture specs were implying that StorageIdentityProvider, irpc
service implementations, and application services (agent, Docker, etc.)
already exist. This commit makes the phasing explicit:

- services.md: deployment topology now clearly labels 'Current (Phase 1)'
  vs 'Future (Phase 2+)', notes that application services are downstream
- identity.md: StorageIdentityProvider labeled 'Future — Phase 2+',
  clarifying alknet-storage doesn't exist yet
- storage.md: adds phase note that the crate hasn't been built yet,
  StorageIdentityProvider is a future impl
- ADR-028: ConfigAuthService is Phase 1 path, StorageAuthService is
  Phase 2+ contract
- call-protocol.md: Agent Service Pattern section explicitly framed as
  a downstream application concern, not a core requirement

docs/architecture/storage.md

@@ -5,9 +5,16 @@ last_updated: 2026-06-07
 
 # Storage
 
+> **Phase note**: `alknet-storage` is a future crate (Phase 2+). This spec
+> defines its contract — the data model, the `IdentityProvider` impl, the
+> irpc service protocol — so that alknet-core can define the traits
+> (`IdentityProvider`) that storage will later implement. The crate itself
+> hasn't been built yet. Phase 1 uses `ConfigIdentityProvider` backed by
+> `ArcSwap<DynamicConfig>`.
+
 ## What
 
-The `alknet-storage` crate provides SQLite-backed graph storage, identity
+The `alknet-storage` crate will provide SQLite-backed graph storage, identity
 management, access control, and reactivity via honker. It mirrors the
 TypeScript `@alkdev/storage` package's design while leveraging Rust's type
 system and honker's built-in pub/sub.
@@ -99,11 +106,11 @@ The ACL graph is a directed, non-multi metagraph:
 Delegation edges carry `narrowed_scopes` — the delegate can only exercise scopes
 that are a subset of the delegator's.
 
-### StorageIdentityProvider
+### StorageIdentityProvider (Future — Phase 2+)
 
-Implements alknet-core's `IdentityProvider` trait (ADR-029). Queries
-`peer_credentials` (for SSH key resolution) and `api_keys` (for token auth), then
-traverses the ACL graph to compute effective scopes and resources.
+Implements alknet-core's `IdentityProvider` trait (ADR-029). This is defined
+here as a contract. When alknet-storage is built, it will provide this
+implementation. Phase 1 uses `ConfigIdentityProvider` backed by `ArcSwap`.
 
 ```rust
 impl IdentityProvider for StorageIdentityProvider {