feat: expose core identity transport

docs/development/repository-workflow.md

@@ -130,9 +130,11 @@ Result: READY WITH WARNINGS
 Doctor is a local, human-readable summary. `pnpm verify`, `pnpm ci:verify`, infrastructure smoke,
 and migration smoke remain the authoritative automated evidence because they exercise formatting,
 boundaries, types, tests, builds, containers, and live mutation/rollback behavior that Doctor does
-not repeat. Identity HTTP transport and an explicit enrollment policy are the next architectural
-phase; Doctor does not diagnose authorization, HTTP routing, runtime module health, or production
-storage yet, and it never constructs an operational Better Auth instance or claims sign-in works.
+not repeat. Core authorization and an explicit platform-owner bootstrap command are the next
+architectural phase; Doctor does not diagnose authorization, the `apps/api` HTTP transport, runtime
+module health, or production storage yet, and it never constructs an operational Better Auth
+instance, starts the API, or claims sign-in works. See [API](api.md) for `pnpm api:start` and the
+identity HTTP transport this repository now has.
 
 Migration planning and application require `DATABASE_URL`. Keep it in the uncommitted `.env`
 created from `.env.example`: