Remove the unused crypto path and write the blob-ID hash step once (closes #151)

Production encryption and decryption already run through blobgen; the crypto package (Encryptor, Decryptor, UpdateRecipients, the fx Module) and Vaultik.GetEncryptor/GetDecryptor had no production caller. Delete crypto and route verify --deep through the same blobgen reader restore uses, parsing the age key once.

The second blob-ID hash step is now one exported blobgen.DoubleSHA256; Writer.Sum256 (the double hash) becomes Writer.ContentID so it no longer collides with Reader.Sum256 (the single plaintext hash). Also delete the never-adopted internal/types newtypes and the uncalled CleanupIncompleteSnapshots and its now-dead deleteSnapshot caller, and correct ARCHITECTURE.md. No production behavior changes.

Model: opus-4-8

internal/types/types.go

@@ -1,7 +1,7 @@
 // Package types provides custom types for better type safety across the
-// vaultik codebase. Using distinct types for IDs, hashes, paths, and
-// credentials prevents accidental mixing of semantically different values
-// that happen to share the same underlying type.
+// vaultik codebase. Using distinct types for IDs, hashes, and paths prevents
+// accidental mixing of semantically different values that happen to share the
+// same underlying type.
 package types //nolint:revive,nolintlint // rename decision tracked in #76
 
 import (
@@ -157,34 +157,6 @@ type FilePath string
 // Used during restore to strip the source prefix from paths.
 type SourcePath string
 
-// AgeRecipient is an age public key used for encryption.
-// Format: age1... (Bech32-encoded X25519 public key)
-type AgeRecipient string
-
-// AgeSecretKey is an age private key used for decryption.
-// Format: AGE-SECRET-KEY-... (Bech32-encoded X25519 private key)
-// This type should never be logged or serialized in plaintext.
-type AgeSecretKey string
-
-// S3Endpoint is the URL of an S3-compatible storage endpoint.
-type S3Endpoint string
-
-// BucketName is the name of an S3 bucket.
-type BucketName string
-
-// S3Prefix is the path prefix within an S3 bucket.
-type S3Prefix string
-
-// AWSRegion is an AWS region identifier (e.g., "us-east-1").
-type AWSRegion string
-
-// AWSAccessKeyID is an AWS access key ID for authentication.
-type AWSAccessKeyID string
-
-// AWSSecretAccessKey is an AWS secret access key for authentication.
-// This type should never be logged or serialized in plaintext.
-type AWSSecretAccessKey string
-
 // Hostname identifies a host machine.
 type Hostname string
 
@@ -199,31 +171,14 @@ type GlobPattern string
 
 // String methods for Stringer interface
 
-func (id FileID) String() string        { return uuid.UUID(id).String() }
-func (id BlobID) String() string        { return uuid.UUID(id).String() }
-func (id SnapshotID) String() string    { return string(id) }
-func (h ChunkHash) String() string      { return string(h) }
-func (h BlobHash) String() string       { return string(h) }
-func (p FilePath) String() string       { return string(p) }
-func (p SourcePath) String() string     { return string(p) }
-func (r AgeRecipient) String() string   { return string(r) }
-func (e S3Endpoint) String() string     { return string(e) }
-func (b BucketName) String() string     { return string(b) }
-func (p S3Prefix) String() string       { return string(p) }
-func (r AWSRegion) String() string      { return string(r) }
-func (k AWSAccessKeyID) String() string { return string(k) }
-func (h Hostname) String() string       { return string(h) }
-func (v Version) String() string        { return string(v) }
-func (r GitRevision) String() string    { return string(r) }
-func (p GlobPattern) String() string    { return string(p) }
-
-// Redacted String methods for sensitive types - prevents accidental logging
-
-func (k AgeSecretKey) String() string       { return "[REDACTED]" }
-func (k AWSSecretAccessKey) String() string { return "[REDACTED]" }
-
-// Raw returns the actual value for sensitive types when explicitly needed.
-func (k AgeSecretKey) Raw() string { return string(k) }
-
-// Raw returns the actual value for sensitive types when explicitly needed.
-func (k AWSSecretAccessKey) Raw() string { return string(k) }
+func (id FileID) String() string     { return uuid.UUID(id).String() }
+func (id BlobID) String() string     { return uuid.UUID(id).String() }
+func (id SnapshotID) String() string { return string(id) }
+func (h ChunkHash) String() string   { return string(h) }
+func (h BlobHash) String() string    { return string(h) }
+func (p FilePath) String() string    { return string(p) }
+func (p SourcePath) String() string  { return string(p) }
+func (h Hostname) String() string    { return string(h) }
+func (v Version) String() string     { return string(v) }
+func (r GitRevision) String() string { return string(r) }
+func (p GlobPattern) String() string { return string(p) }