Remove the unused crypto path and write the blob-ID hash step once (closes #151)

Production encryption and decryption already run through blobgen; the crypto package (Encryptor, Decryptor, UpdateRecipients, the fx Module) and Vaultik.GetEncryptor/GetDecryptor had no production caller. Delete crypto and route verify --deep through the same blobgen reader restore uses, parsing the age key once.

The second blob-ID hash step is now one exported blobgen.DoubleSHA256; Writer.Sum256 (the double hash) becomes Writer.ContentID so it no longer collides with Reader.Sum256 (the single plaintext hash). Also delete the never-adopted internal/types newtypes and the uncalled CleanupIncompleteSnapshots and its now-dead deleteSnapshot caller, and correct ARCHITECTURE.md. No production behavior changes.

Model: opus-4-8

internal/blobgen/reader.go

@@ -64,7 +64,9 @@ func (r *Reader) Close() error {
 	return nil
 }
 
-// Sum256 returns the SHA256 hash of all data read
+// Sum256 returns the single SHA-256 of the plaintext read so far. This is the
+// first hash only; the stored object name is its double hash, which callers
+// obtain by passing this digest to DoubleSHA256.
 func (r *Reader) Sum256() []byte {
 	return r.hasher.Sum(nil)
 }