feat: rename crates/ → vessels/ + add El ports per sub-vessel

Belated rename commit for foundation/el-ui — was missed in the
workspace-wide crates→vessels pass earlier today. Same structural
intent as the rename in the other repos: 'crates' is the Rust word,
'vessel' is El's, and the directory rename is the marker that this
slot holds an El buildable unit even if its current contents are
still Rust pending port.

Plus the El ports themselves — manifest.el + src/main.el per sub-
vessel (el-aop, el-auth, el-config, el-i18n, el-identity, el-layout,
el-platform, el-publish, el-secrets, el-services, el-style, el-ui-
compiler). The ui-compiler is a stub: elc only emits C right now;
generating browser-target JS/Wasm is the biggest open language gap
and gets its own project. Until then, el-ui-compiler emits a JS
module that throws elc.backend_missing so callers fail loudly.
Cross-repo path dependencies in Cargo.toml updated to vessels/.

vessels/el-identity/src/error.rs

@@ -0,0 +1,56 @@
+//! IdentityError — all errors from the el-identity system.
+
+use thiserror::Error;
+
+#[derive(Debug, Error, Clone)]
+pub enum IdentityError {
+    #[error("user not found: {0}")]
+    UserNotFound(String),
+
+    #[error("session not found or expired")]
+    SessionNotFound,
+
+    #[error("session expired")]
+    SessionExpired,
+
+    #[error("OAuth error: {0}")]
+    OAuthError(String),
+
+    #[error("OAuth provider not configured: {0}")]
+    ProviderNotConfigured(String),
+
+    #[error("token exchange failed: {status} {body}")]
+    TokenExchangeFailed { status: u16, body: String },
+
+    #[error("token refresh failed: {0}")]
+    TokenRefreshFailed(String),
+
+    #[error("PKCE verification failed")]
+    PkceVerificationFailed,
+
+    #[error("graph error: {0}")]
+    GraphError(String),
+
+    #[error("serialization error: {0}")]
+    SerializationError(String),
+
+    #[error("authentication required")]
+    Unauthenticated,
+
+    #[error("forbidden: requires role '{0}'")]
+    Forbidden(String),
+
+    #[error("forbidden: requires scope '{0}'")]
+    ScopeForbidden(String),
+
+    #[error("invalid credentials")]
+    InvalidCredentials,
+
+    #[error("role not found: {0}")]
+    RoleNotFound(String),
+
+    #[error("node not found: {0}")]
+    NodeNotFound(String),
+}
+
+pub type IdentityResult<T> = Result<T, IdentityError>;