Remove the unused crypto path and write the blob-ID hash step once (closes #151)

Production encryption and decryption already run through blobgen; the crypto package (Encryptor, Decryptor, UpdateRecipients, the fx Module) and Vaultik.GetEncryptor/GetDecryptor had no production caller. Delete crypto and route verify --deep through the same blobgen reader restore uses, parsing the age key once.

The second blob-ID hash step is now one exported blobgen.DoubleSHA256; Writer.Sum256 (the double hash) becomes Writer.ContentID so it no longer collides with Reader.Sum256 (the single plaintext hash). Also delete the never-adopted internal/types newtypes and the uncalled CleanupIncompleteSnapshots and its now-dead deleteSnapshot caller, and correct ARCHITECTURE.md. No production behavior changes.

Model: opus-4-8

internal/vaultik/blob_fetch.go

@@ -2,7 +2,6 @@ package vaultik
 
 import (
 	"context"
-	"crypto/sha256"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -57,11 +56,7 @@ func (h *hashVerifyReader) Close() error {
 		return errBlobNotFullyRead
 	}
 
-	firstHash := h.reader.Sum256()
-	secondHasher := sha256.New()
-	secondHasher.Write(firstHash)
-
-	actualHashHex := hex.EncodeToString(secondHasher.Sum(nil))
+	actualHashHex := hex.EncodeToString(blobgen.DoubleSHA256(h.reader.Sum256()))
 	if actualHashHex != h.blobHash {
 		return fmt.Errorf("%w: expected %s, got %s",
 			errBlobHashMismatch, h.blobHash[:16], actualHashHex[:16])