docs: publish the Web Foundations application onramp

Sanitized snapshot of private source 144ca0a9544042b0477ae732c1356cf0b9d62b3f. Add package selection, adoption workflow, and optional Sandwich Hime integration guidance.

AI-Assistance: OpenAI Codex assisted documentation, verification, and publication.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

docs/ARCHITECTURE.md

@@ -2,16 +2,17 @@
 
 # Architecture
 
-The dependency direction is intentionally one-way:
+The package dependency direction is intentionally one-way:
 
 ```text
-net/http application
-  -> requestmeta
-  -> requestlog / websec / abuse / authhttp
-  -> auth and analytics interfaces
-  -> optional authsqlite and JSONL adapters
+analytics ──> requestlog ──> requestmeta
+abuse ─────────────────────> requestmeta
+authhttp ──> websec ───────> requestmeta
+authhttp ──> auth <───────── authsqlite
 ```
 
+An ordinary `net/http` application composes whichever branches it needs.
+
 Packages never own application routes, templates, authorization policy, cache
 policy, or deployment. Middleware communicates through typed request context.
 Storage and reporting surfaces are interfaces so an application can retain its
@@ -20,4 +21,5 @@ time.
 
 The package model is developed from explicit threat and data contracts, not by
 moving an existing application's internals into a shared directory. See
-[ADOPTION.md](ADOPTION.md).
+[ADOPTION.md](ADOPTION.md), [GETTING_STARTED.md](GETTING_STARTED.md), and the
+[module-boundary policy](MODULES.md).