docs: define deployment trust boundaries

One canonical security document, linked from the README, platform architecture,
and module-development guide, stating what the boundaries actually protect
against — and, more importantly, what they do not.

Installed modules are trusted compiled backend code. A module runs arbitrary
JavaScript inside the API process and shares its PostgreSQL role and pool, so
`ModuleDatabase.execute` gives it the API's full database authority over every
table, including identity, grants, owner, bootstrap, and audit. Table prefixes,
manifests, permission declarations, route validation, frozen contexts, typed
facades, and the capability registry are correctness and coordination boundaries
that assume a cooperative module; none of them constrains one that is not. There
is no process, container, syscall, filesystem, network, database-role, schema,
tenant, or resource sandbox between a module and Core, and the document says so
in those words, along with what would have to be built before untrusted modules
could be accepted.

It also records the honest deployment state: Ekklesia is not deployed. There is
no production instance, reverse proxy, public listener, or deployment automation
anywhere in this repository, and no `.env` has ever been committed. The loopback
listen default and the production signup refusal are real, but a config default
is not a firewall, so the origin-reachability, proxy-overwrite, header-spoofing,
and trusted-peer properties a public launch needs are written as a
launch-blocking checklist rather than as guarantees. The per-process
authentication limiter is described as exactly that, valid only while signup
stays disabled and exactly one instance serves traffic.

The CI section records the workflow's verified posture and deliberately stops
there: a pull request can edit `runs-on`, so a workflow file cannot be the
boundary, and the runner topology is not described as though it had been
verified.

Co-Authored-By: Claude Opus 5 <[email protected]>

docs/module-development/README.md

@@ -3,6 +3,12 @@
 An Ekklesia module is a backend capability package. It owns business behavior and data declarations;
 it never owns components, styles, layouts, renderers, navigation, or other UI.
 
+> **Before you publish or install a module:** modules are trusted compiled backend code. Your
+> module runs arbitrary JavaScript inside the API process and shares its PostgreSQL role, and
+> nothing in this guide — manifests, permission declarations, typed facades, route validation,
+> frozen contexts — isolates it. An operator installing your module is deploying trusted server
+> code. See [Security model and deployment trust boundaries](../development/security.md).
+
 ## Required package shape
 
 Each immediate child of `modules/` must be an ESM workspace package with a unique package name, a