phase 1: architecture spec — overview, server/client, ADR-001..006

- ADR-001: inherit the alknet TLS design as the baseline; deviations
  recorded as alktls ADRs
- ADR-002: TlsError ships the ADR-088 six-variant shape from day one
  (typed #[from] sources; NoqWrap; no string catch-all)
- ADR-003: the QUIC feature is noq (iroh's extracted fork), pre-
  consumer rename; default = [] per the lean-crate convention
  (corrects the extracted code's default = ["quinn"])
- ADR-004: complete accessors — for_tcp_tls() adopted, rustls_config()
  adopted; server accessors borrow (&self), client accessors consume
- ADR-005: identity + credentials + fingerprint types move into
  alktls; auth layer stays out
- ADR-006: eight-module layout; seed tests + integration invariant
  pins (exact nine-scheme list, client enable_early_data)
- specs: overview (transport picture, terminology), server.md (ACME
  lifecycle, invariants), client.md (verifier selection matrix, root-
  store fallback); open-questions.md promotes OQ-TLS-01..08 (all
  resolved at entry)
- Cargo.toml: quinn feature -> noq (per ADR-003); AGENTS.md aligned

Architecture review pass done: 0 critical, 2 major (ADR-002 AcmeConfig
doc comment contradiction; ADR-003 unrecorded default deviation) and
8 minors all addressed; cross-references verified against alknet ADRs,
rustls/noq/iroh sources.

Verified: cargo test, test --all-features, clippy -D warnings,
fmt --check, doc --no-deps

Cargo.toml

@@ -6,7 +6,7 @@ rust-version = "1.88"
 license = "MIT OR Apache-2.0"
 description = "Shared TLS setup types: server and client rustls configs, cert resolvers, verifiers, and ACME state-machine wiring, transport-agnostic and shareable across transports."
 repository = "https://git.alk.dev/alkdev/alktls"
-keywords = ["tls", "rustls", "acme", "quinn", "network"]
+keywords = ["tls", "rustls", "acme", "noq", "network"]
 categories = ["network-programming", "cryptography", "asynchronous"]
 exclude = [".opencode/", "AGENTS.md", "docs/reviews/", "docs/research/", "docs/plans/", "docs/sdd_process.md"]
 
@@ -14,8 +14,8 @@ exclude = [".opencode/", "AGENTS.md", "docs/reviews/", "docs/research/", "docs/p
 name = "alktls"
 
 [features]
-default = ["quinn"]
-quinn = ["dep:quinn"]
+default = []
+noq = ["dep:noq", "dep:noq-proto"]
 tcp = ["dep:tokio-rustls"]
 acme = ["dep:rustls-acme"]
 
@@ -33,7 +33,8 @@ tracing = "0.1"
 thiserror = "2"
 
 futures = { version = "0.3", optional = true }
-quinn = { version = "0.11", optional = true }
+noq = { version = "1.2", optional = true, default-features = false, features = ["rustls"] }
+noq-proto = { version = "1.2", optional = true, default-features = false }
 tokio-rustls = { version = "0.26", optional = true }
 rustls-acme = { version = "0.12", optional = true, features = ["aws-lc-rs"] }