docs: correct module authorization comments

apps/api/src/authorization-middleware.ts

@@ -17,9 +17,11 @@ function sanitizedDenial(c: Context, status: 403 | 503, code: string): Response
 }
 
 /**
- * Builds a Hono middleware that enforces `permissionId`, resolved exclusively from Core's own
- * trusted, server-side permission registry — a route never supplies its own baseline, and no
- * request input can influence which baseline is checked. The principal is resolved exclusively
+ * Builds a Hono middleware that enforces `permissionId`, resolved exclusively from the injected,
+ * trusted, server-side `PermissionRegistry` — in production, the complete platform registry
+ * `startApi` composes from Core's own declarations plus every installed module's, never a
+ * Core-only fallback. A route never supplies its own baseline, and no request input can influence
+ * which baseline is checked. The principal is resolved exclusively
  * through the injected identity runtime (`resolvePrincipal`), the same one `/api/v1/principal`
  * already uses; nothing here ever trusts a client-supplied claim about identity, ownership, or
  * grants. A permission id that is not registered fails closed (403) exactly like a denied