docs: integrate static frontend architecture

.project-docs/40-domain/business-rules.md

@@ -9,9 +9,12 @@
 - Super administrators calculate and record generation cost without checking, freezing, or refunding organization quota.
 - All new organization balance entries are organization-owned; generation charge/refund entries keep member attribution for consumption reporting.
 - Logged-in users may change their own password; account management and organization member actions require admin roles.
-- Public `/api/v1` access authenticates with API keys and stays outside browser SSO middleware; API data is partitioned by the API account owner.
+- Public `/api/v1` access authenticates with API keys rather than the browser
+  session Cookie; API data is partitioned by the API account owner.
 - Database schema changes stay versioned and checksummed in `database/migrations/`; the initial production schema is created by manually executing the SQL files plus application-role grants (no migration Job pod), and schema changes must never run inside long-lived pod startup.
 - Generated and uploaded assets remain runtime/object-storage state; PostgreSQL does not make them shared for horizontal scaling.
+- Client-side route guards are navigation/UI behavior only; Go authorizes every
+  protected API and file request.
 
 ## Open Questions
 
@@ -19,4 +22,4 @@
 
 ## Last Reviewed
 
-2026-08-14
+2026-08-16