feat: prepare ARR for controlled public deployment

.project-docs/20-architecture/module-map.md

@@ -0,0 +1,27 @@
+# Module Map
+
+## Source Layout
+
+| Path | Responsibility | Owner Notes |
+|---|---|---|
+| `arr_web/` | Upload portal and business API | Manual monthly request code conflicts with ADR-001. |
+| `arr_mcp/` | Direct Agent-result submission and ingestion boundary | Post-commit trigger should originate at or after this boundary, not before it. |
+| `arr_ingestion/`, `arr_processing/` | Validate and persist structured processing results | Keep deterministic replay and transaction semantics. |
+| `monthly_reports/` | Database-backed monthly workbook generation | Needs formula-cell output and automatic orchestration integration. |
+| `database/` | Finance facts, views, guards and migrations | Database total remains useful for integrity checks. |
+| `Dockerfile`, `compose.yaml` | Reproducible single-server Web/MCP runtime | Compose explicitly enables XML processing; source defaults remain fail-closed. |
+| `deploy/` | Caddy TLS/auth boundary, production env template and operator runbook | Only Caddy publishes host ports; never commit the real production env file. |
+| `tests/` | Regression and acceptance coverage | Add post-commit trigger and formula-cell assertions when implementation is authorized. |
+
+## Dependency Direction
+
+- Upload/Agent/ingestion writes validated facts; report modules depend on committed facts and must not call back into XML parsing.
+- Public traffic enters through Caddy; Web and MCP stay on the internal Compose network and use separate browser/MCP authentication boundaries.
+
+## Risky Or Sensitive Areas
+
+- Commit-to-trigger atomicity/idempotency, monthly snapshot selection, XLSX formula preservation, and PII-safe result metadata.
+
+## Last Updated
+
+2026-07-29