Remove the unused crypto path and write the blob-ID hash step once (closes #151)

Production encryption and decryption already run through blobgen; the crypto package (Encryptor, Decryptor, UpdateRecipients, the fx Module) and Vaultik.GetEncryptor/GetDecryptor had no production caller. Delete crypto and route verify --deep through the same blobgen reader restore uses, parsing the age key once.

The second blob-ID hash step is now one exported blobgen.DoubleSHA256; Writer.Sum256 (the double hash) becomes Writer.ContentID so it no longer collides with Reader.Sum256 (the single plaintext hash). Also delete the never-adopted internal/types newtypes and the uncalled CleanupIncompleteSnapshots and its now-dead deleteSnapshot caller, and correct ARCHITECTURE.md. No production behavior changes.

Model: opus-4-8

internal/blobgen/reader_test.go

@@ -0,0 +1,54 @@
+package blobgen_test
+
+import (
+	"bytes"
+	"io"
+	"testing"
+
+	"filippo.io/age"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/blobgen"
+)
+
+// TestMultipleRecipients verifies that data written for several recipients can
+// be read back by each recipient's identity. Moved from internal/crypto, which
+// held the only multi-recipient test; blobgen is now the sole encryption path.
+func TestMultipleRecipients(t *testing.T) {
+	t.Parallel()
+
+	identities := make([]*age.X25519Identity, 3)
+	recipients := make([]string, 3)
+
+	for i := range identities {
+		identity, err := age.GenerateX25519Identity()
+		require.NoError(t, err)
+
+		identities[i] = identity
+		recipients[i] = identity.Recipient().String()
+	}
+
+	plaintext := []byte("Secret message for multiple recipients")
+
+	var encrypted bytes.Buffer
+
+	writer, err := blobgen.NewWriter(&encrypted, 3, recipients)
+	require.NoError(t, err)
+	_, err = writer.Write(plaintext)
+	require.NoError(t, err)
+	require.NoError(t, writer.Close())
+
+	// Every recipient's identity must recover the original plaintext.
+	for i, identity := range identities {
+		reader, err := blobgen.NewReader(
+			bytes.NewReader(encrypted.Bytes()), identity)
+		require.NoError(t, err, "recipient %d should open the reader", i+1)
+
+		got, err := io.ReadAll(reader)
+		require.NoError(t, err, "recipient %d should read the plaintext", i+1)
+		require.NoError(t, reader.Close())
+
+		assert.Equal(t, plaintext, got,
+			"recipient %d should recover the original plaintext", i+1)
+	}
+}