rename crates/ to engrams/, bindings/ to receptors/

- crates/ → engrams/ (Rust engrams live here)
- bindings/ → receptors/ (cross-language access points into the graph)
- Cargo.toml workspace paths updated

engrams/engram-crypto/src/lib.rs

@@ -0,0 +1,43 @@
+/// Engram Crypto — quantum-secure encryption at rest.
+///
+/// # Current Implementation
+///
+/// Uses AES-256-GCM for symmetric encryption with BLAKE3 for key derivation.
+/// AES-256 is already quantum-resistant (Grover's algorithm halves the key space
+/// from 2^256 to 2^128, which remains computationally infeasible).
+///
+/// # Post-Quantum Upgrade Path
+///
+/// The `AlgorithmRegistry` stores an `algorithm_id` alongside every ciphertext.
+/// When ML-KEM (CRYSTALS-Kyber) and ML-DSA (CRYSTALS-Dilithium) crates stabilize,
+/// the upgrade is:
+/// 1. Add `KemAlgorithm::MlKem768` / `MlKem1024` variants
+/// 2. Implement `CryptoEngine::encrypt()` for the new algorithm
+/// 3. Set it as the active algorithm in the registry
+/// 4. Old records continue to decrypt via their stored `algorithm_id`
+/// 5. Background re-encryption rotates old records to the new algorithm
+///
+/// No data migration required — the registry handles version negotiation.
+///
+/// # Usage
+///
+/// ```rust,no_run
+/// use engram_crypto::{CryptoEngine, AlgorithmRegistry};
+///
+/// let key = b"an-example-32-byte-key!!12345678";
+/// let engine = CryptoEngine::from_key(key).unwrap();
+///
+/// let plaintext = b"sensitive memory content";
+/// let encrypted = engine.encrypt(plaintext).unwrap();
+/// let decrypted = engine.decrypt(&encrypted).unwrap();
+/// assert_eq!(plaintext, decrypted.as_slice());
+/// ```
+pub mod algorithm;
+pub mod engine;
+pub mod error;
+pub mod registry;
+
+pub use algorithm::{AlgorithmVersion, KemAlgorithm, SigAlgorithm};
+pub use engine::{CryptoEngine, EncryptedContent};
+pub use error::CryptoError;
+pub use registry::AlgorithmRegistry;