docs: record module HTTP architecture

Phase 5B, pass 3: adds ADR 0015 recording the durable module HTTP
routing and production runtime lifecycle architecture pass 1 and pass
2 implemented, extending ADR 0006 and ADR 0014 without superseding
either. Adds narrow cross-reference notes to both, and to the ADR
index, pointing at ADR 0015 for the work they deferred, while
preserving their historical text and accepted status.

Corrects stale forward-looking "pass 2"/future-tense language left
over from pass 1 in core/src/modules/runtime.ts and
packages/contracts/src/module-http.ts (comment-only; production
behavior unchanged), and a shutdown-lifecycle description in
docs/development/testing.md that predated the module-runtime-stop
step pass 2 added between draining the HTTP server and closing the
pool.

Full audit against origin/main...HEAD found the architecture,
contract, startup ordering, routing, authorization/origin
enforcement, and PostgreSQL integration coverage from passes 1-2
sound; the one concrete defect found (Vary-header merge producing an
invalid "*, Origin, Cookie" combination and case-sensitive duplicate
tokens) was already fixed with focused regression tests in a separate
commit (bf76f4e), not amending either checkpoint commit.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

docs/development/testing.md

@@ -22,13 +22,18 @@ error-only sanitized logger that strips Better Auth's own message and arguments
 they contain, pinned 8–128 password-length bounds, sanitized failures, and that a database outage
 during principal resolution is never silently reported as anonymous), and Core migration discovery
 (deterministic ordering, the reserved `core` identity, and collision rejection) — all without a
-live database. `apps/api`'s own unit tests cover its pure Hono app factory (route shapes, CORS
-allow/deny/preflight, deterministic 404 and sanitized error responses), its runtime configuration,
-its idempotent shutdown lifecycle (concurrent callers share one server-close-then-pool-close
-promise; a startup failure after the pool was already created still closes it; `SIGINT`/`SIGTERM`
-wiring is exercised through an injectable exit function rather than the real `process.exit`), and
-that importing any of its modules — including the executable server module without calling its
-exported `main` — never reads the environment, connects to PostgreSQL, or starts a server.
+live database. `apps/api`'s own unit tests cover its pure Hono app factory (route shapes, module
+route mounting/enforcement/CORS/response sanitization, CORS allow/deny/preflight, deterministic 404
+and sanitized error responses), its runtime configuration, its idempotent shutdown lifecycle
+(concurrent callers share one server-close-then-module-runtime-stop-then-pool-close promise; a
+module-stop failure never prevents pool cleanup; a startup failure after the pool was already
+created still closes it, stopping the module runtime first if it had already started;
+`SIGINT`/`SIGTERM` wiring is exercised through an injectable exit function rather than the real
+`process.exit`), and that importing any of its modules — including the executable server module
+without calling its exported `main` — never reads the environment, connects to PostgreSQL, imports
+a module entrypoint, or starts a server. Real, working (non-throwing) module fixtures prove
+production module-runtime startup/shutdown ordering and cleanup against a mocked pool/Better
+Auth/server — see [Authorization](authorization.md#tests).
 
 `pnpm verify` is intentionally Docker-free. It never plans or applies migrations against a live
 database.