docs: integrate RDS and ACK architecture memory

.project-docs/20-architecture/module-map.md

@@ -4,15 +4,24 @@
 
 | Path | Responsibility | Owner Notes |
 |---|---|---|
+| `lib/server/database.ts` | Server-only PostgreSQL Pool, TLS, queries, transactions, readiness | Only deep database transport boundary for runtime stores. |
+| `lib/server/{data-store,account-store,billing-store}.ts` | Domain persistence with PostgreSQL/local implementations | Preserve exported interfaces for callers. |
+| `database/migrations/` | Immutable versioned PostgreSQL schema changes | Applied by `scripts/migrate-postgres.mjs`. |
+| `scripts/postgres-client.mjs` | Validated database configuration for Node operations scripts | Shared by migration/bootstrap/import scripts. |
+| `deploy/ack/` | ACK deployment resources and secret/config templates | Migration Job precedes Web/Worker rollout. |
+| `app/api/ready/route.ts` | Database/schema/privilege readiness endpoint | Separate from process-level liveness. |
 
 ## Dependency Direction
 
-- {dependency direction rule}
+- Routes and services depend on store interfaces; stores depend on the shared database adapter; the adapter does not depend on domain stores.
+- Worker depends on the internal Web HTTP API, not the database module.
 
 ## Risky Or Sensitive Areas
 
-- {module or path that needs extra care}
+- `database/migrations/` and the two concurrency-sensitive PostgreSQL functions.
+- Account authentication/password transactions and billing wallet idempotency.
+- ACK Secrets, RDS CA mounting, Ingress protection for internal Worker routes, and pool connection budgeting.
 
 ## Last Updated
 
-{YYYY-MM-DD}
+2026-08-12