docs: integrate plaintext PostgreSQL decision

.project-docs/20-architecture/module-map.md

@@ -11,7 +11,7 @@
 | `database/migrations/` | Immutable versioned PostgreSQL schema changes | Executed manually/through dedicated operator CI; no migration Job reuses Web. |
 | `deploy/ack/` | Seven ACK manifests plus Secret template | Static Web + Go topology; Web has no runtime config/Secret and Go owns the session Secret. |
 | `backend/cmd/zhinian-api` | Go application entrypoint, configuration, HTTP server composition, health/readiness | Sole runtime API owner targeted by checked-in Ingress. |
-| `backend/internal/*` | ADR-003 deep modules and adapters, 18 packages: `identity`, `administration`, `assets`, `billing`, `usage`, `jobs`, `providers`, `webhook`, `httpapi`, `publicapi`, `application`, `orchestration`, `postgres`, `localstore`, `logging`, `settings`, `templates`, `prompt` | Implemented in `b14b4fc`; publication of immutable images and rollout of the static Web + Go revision remain pending. |
+| `backend/internal/*` | ADR-003 deep modules and adapters, 18 packages: `identity`, `administration`, `assets`, `billing`, `usage`, `jobs`, `providers`, `webhook`, `httpapi`, `publicapi`, `application`, `orchestration`, `postgres`, `localstore`, `logging`, `settings`, `templates`, `prompt` | Implemented in `b14b4fc`; `ed97814` enforces plaintext PostgreSQL. Publication of immutable images and live rollout remain pending. |
 | `contracts/**/*.json` | Language-neutral HTTP/Cookie/auth/jobs/billing/storage/webhook contract fixtures | Shared acceptance source for TypeScript and Go consumers. |
 
 ## Dependency Direction
@@ -46,7 +46,8 @@ Real internal seams are PostgreSQL transport, object storage, generation provide
 
 - `database/migrations/` and the two concurrency-sensitive PostgreSQL functions.
 - Account authentication/password transactions and billing wallet idempotency.
-- ACK Secrets, RDS CA mounting, Ingress protection for internal Worker routes, and pool connection budgeting.
+- ACK Secrets, private-network enforcement for unencrypted RDS traffic,
+  Ingress protection for internal Worker routes, and pool connection budgeting.
 - `backend/internal/{postgres,jobs,billing}`: claim and wallet correctness across Go replica scaling until WorkerLoop concurrency is deliberate.
 - Static Web image construction/container startup still needs CI smoke evidence.
 - Go `emptyDir` file state is lost on Pod replacement when OSS is absent.