docs: document module database access

Add ADR 0016 recording the accepted module database access design (ModuleDatabase, the frozen
ModuleRuntimeServices boundary, one pool/one facade/one services-object identity, explicit
migrations, and the trust model), with narrow cross-reference corrections to ADR 0006 and ADR 0015
where their original text is now inaccurate. Sweep docs/development/api.md,
docs/development/authorization.md, docs/module-development/README.md, docs/development/testing.md,
and docs/development/identity.md for the new database boundary and remaining Phase 4C staleness;
correct the stale "Phase 4C is next" roadmap paragraph in platform-architecture.md and the matching
gap in README's current-status narrative. Extend the module template with a permissioned
GET /records route reading through context.services.database, using the canonical
createModuleTable helper, with matching template tests.

templates/module/src/schema/tables.ts

@@ -1,6 +1,7 @@
-import { pgTableCreator, text, uuid } from "drizzle-orm/pg-core";
+import { createModuleTable } from "@ekklesia/module-sdk";
+import { text, uuid } from "drizzle-orm/pg-core";
 
-const moduleTable = pgTableCreator((localName) => `example_${localName}`);
+const moduleTable = createModuleTable("example");
 
 export const records = moduleTable("records", {
   id: uuid("id").primaryKey(),