docs(arch): land ADR-070 BidiStreamSource + OQ-55 AlknetClient deferral + impl task

Three core-crate changes surfaced by the alknet-channels POC:

- ADR-070: extract BidiStreamSource trait so Connection holds
  Box<dyn BidiStreamSource> instead of a closed ConnectionKind enum;
  downstream crates (channels, future transports) implement the trait
  to add connection shapes without editing core. Public Connection API
  preserved verbatim. REQ-CORE-02 (close() params clippy warning under
  --no-default-features) folded in — the signature stays on the trait,
  non-QUIC impls ignore the args.

- OQ-55: AlknetClient / client establishment extraction deferred(scope).
  Blocked on a second *transport's* real client (not a second QUIC
  client) — extracting a QUIC-shaped connector now would bake QUIC in
  as the establishment shape, the same welding ADR-065 unwound on the
  server side. Each crate builds its own client standalone for now.

- core-types.md / auth.md / overview.md / README indexes updated to
  reflect ADR-070 and OQ-55. Architecture review: zero critical issues.

- tasks/core/bidistreamsource-trait.md: the implementation task (Parts
  1-3: BidiStreamSource refactor, close() fix, AuthContext::anonymous).

docs/architecture/crates/core/auth.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-07-05
+last_updated: 2026-07-12
 ---
 
 # Authentication
@@ -84,6 +84,25 @@ The connection-level identity is stable — set once when the handler resolves i
 - `derive(Clone)` allows handlers to clone `AuthContext` for per-stream or per-channel contexts.
 - `handle()` receives `&AuthContext` — immutable. Handlers that resolve identity create local variables, they don't mutate the shared context. This prevents cross-contamination between streams on the same connection.
 
+### `AuthContext::anonymous` constructor
+
+```rust
+impl AuthContext {
+    /// Construct an `AuthContext` with no identity, no fingerprint, and no
+    /// remote address — only the ALPN is set. For POCs, tests, and handlers
+    /// that don't require auth.
+    pub fn anonymous(alpn: impl Into<Vec<u8>>) -> Self;
+}
+```
+
+A convenience constructor that sets `identity: None`, `remote_addr: None`,
+`tls_client_fingerprint: None`, and `alpn` to the provided value. This
+removes the four-`None`-field literal that recurred in every handler POC
+and test (`poc-summary.md` §"Issues Surfaced" #3). The name is honest about
+the semantics: no identity, no fingerprint. Not gated behind a
+`test-utils` feature — it's a plain `pub fn` useful for any caller that
+constructs an `AuthContext` outside the endpoint's resolution path.
+
 ## Identity
 
 The authenticated peer identity. Carries authorization information.