docs: remove CallCredentials — dead field, dead from_call path, auth_token is per-request payload

ADR-091 amended 2026-07-17: CallCredentials removed (not retained in
alknet-call). Trace showed CallCredentials.auth_token had no reader
(connect() read only tls_identity + remote_identity; spawn_dispatch
takes no credentials; from_call's credentials_auth_token was a
different type, always None, never connected). auth_token is a
per-request payload field — browsers send it in the WS payload; the
HTTP gateway resolves bearer → Identity at its boundary.

from_call's credentials_auth_token dead path removed in the same pass
(OpSummary field, handler params, build_forwarded_payload param, and
the two tests asserting the never-exercised Some path).

ADR-089 §5 further amended, ADR-080 noted, all spec READMEs and
overview updated. Migration plan (findings.md) corrected: Phase 5
prune now includes CallCredentials removal + from_call dead-path
removal; test audit corrected (4 unchanged + 2 move to core, not 6
unchanged); integration-test split documented; all 'or' hedges
resolved.

docs/architecture/crates/hub/README.md

@@ -312,7 +312,7 @@ impl Hub {
     pub async fn connect_quic_worker(
         &self,
         addr: SocketAddr,
-        credentials: CallCredentials,
+        credentials: ConnectionCredentials,
         config: FromCallConfig,
     ) -> Result<(PeerId, ChannelClient), HubError>;
 }
@@ -542,7 +542,7 @@ impl Hub {
 ```
 
 The supervision loop takes a `dial` closure rather than a `SocketAddr`
-+ `CallCredentials` pair. This keeps the loop transport-agnostic —
++ `ConnectionCredentials` pair. This keeps the loop transport-agnostic —
 the caller decides the transport by what the closure does. The
 backoff and re-discovery logic is the same regardless of transport.