docs: record module HTTP architecture

Phase 5B, pass 3: adds ADR 0015 recording the durable module HTTP
routing and production runtime lifecycle architecture pass 1 and pass
2 implemented, extending ADR 0006 and ADR 0014 without superseding
either. Adds narrow cross-reference notes to both, and to the ADR
index, pointing at ADR 0015 for the work they deferred, while
preserving their historical text and accepted status.

Corrects stale forward-looking "pass 2"/future-tense language left
over from pass 1 in core/src/modules/runtime.ts and
packages/contracts/src/module-http.ts (comment-only; production
behavior unchanged), and a shutdown-lifecycle description in
docs/development/testing.md that predated the module-runtime-stop
step pass 2 added between draining the HTTP server and closing the
pool.

Full audit against origin/main...HEAD found the architecture,
contract, startup ordering, routing, authorization/origin
enforcement, and PostgreSQL integration coverage from passes 1-2
sound; the one concrete defect found (Vary-header merge producing an
invalid "*, Origin, Cookie" combination and case-sensitive duplicate
tokens) was already fixed with focused regression tests in a separate
commit (bf76f4e), not amending either checkpoint commit.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

core/src/modules/runtime.ts

@@ -518,9 +518,9 @@ async function startModules(
  * Starts the module runtime from a module list the caller already discovered — performs no
  * module-directory scan or manifest read of its own, and preserves the given list's order exactly.
  * `startModuleRuntime` below is the convenient discovery-plus-start wrapper most callers want;
- * `apps/api`'s production startup (pass 2) will call this form directly so permission composition
- * and module HTTP/runtime startup share Phase 5A's exact same one-time discovery rather than
- * discovering modules twice.
+ * `apps/api`'s production startup calls this form directly (`prepareStartupModuleInventory`,
+ * `apps/api/src/platform-permissions.ts`) so permission composition and module HTTP/runtime
+ * startup share the exact same one-time discovery rather than discovering modules twice.
  */
 export async function startDiscoveredModuleRuntime(
   discoveredModules: readonly DiscoveredModule[],