docs: state exactly what ADR 0045's browser smoke proves

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/architecture/decisions/0045-split-dashboard-and-api-origins.md

@@ -181,10 +181,13 @@ host-only session cookie.
 Because those are browser behaviors, the split run also drives a **real browser**: a headless
 Chromium from an image pinned by digest, controlled over the Chrome DevTools Protocol by the
 smoke-test client with no added dependency. In it, a person signs in through the real form on the
-Dashboard hostname, the Dashboard loads a module's UI and contribution from the API hostname, the
+Dashboard hostname, the session cookie is present only for the API hostname, the Dashboard imports a
-session cookie is present only for the API hostname, the module's display page mounts on the API
+module's UI from the API hostname and the module's own credentialed requests succeed under CORS, no
-hostname, and sign-out ends the session. The split run installs the repository's module template as
+request is refused, the module's display page mounts on the API hostname with its service worker, and
-a test-only module so these paths exist; installations' own smoke tests cover their real modules.
+sign-out ends the session. The split run installs the repository's module template as a test-only
+module so these paths exist; installations' own smoke tests cover their real modules. Contribution
+artifacts are imported exactly as UI artifacts are, and the API's tests cover their CORS headers and
+those of realtime streams.
 
 ## Consequences