feat: port el-ui vessels — rename crates→vessels, add El source + manifests

ui/vessels/el-identity/src/lib.rs

@@ -0,0 +1,37 @@
+//! el-identity — Engram-native identity for el-ui.
+//!
+//! Identity is not a bolt-on — it is activation spreading through the graph.
+//! Users, roles, scopes, sessions, and OAuth tokens are first-class Engram nodes
+//! connected by typed edges.
+//!
+//! ```text
+//! User ──has_role──▶ Role ──grants──▶ Scope
+//!  │
+//!  └──has_session──▶ Session ──authenticated_via──▶ OAuthToken
+//! ```
+//!
+//! Security-by-default: `@authenticate` is applied to every endpoint.
+//! `@public` is the explicit opt-out.
+
+#![deny(warnings)]
+
+pub mod context;
+pub mod engram;
+pub mod error;
+pub mod guard;
+pub mod nodes;
+pub mod oauth;
+pub mod provider;
+pub mod session;
+
+pub use context::IdentityContext;
+pub use engram::{EngramClient, MockEngramClient};
+pub use error::{IdentityError, IdentityResult};
+pub use guard::AuthGuard;
+pub use nodes::{OAuthToken, Role, Scope, Session, User};
+pub use oauth::{OAuthFlow, PkceChallenge};
+pub use provider::{AppleOAuth, GithubOAuth, GoogleOAuth, OAuthProvider};
+pub use session::SessionManager;
+
+#[cfg(test)]
+mod tests;