feat(door): P2 connections + SSRF-safe executor + native adapter + audit

Migration 035 adds door_connections (per-space controller integration:
secret_ref -> AES-256-GCM secrets vault, never a plaintext password;
pinned_host SSRF pin; native_heatsync|generic_http adapter;
allow_member_self_entry opt-in for phase 3) and door_access_log
(append-only, secrets redacted, service-client-only writes; immutable).
RLS additive/default-deny: connections CRUD = door.manage; log SELECT =
door.manage/operate.

Safety core is pure and heavily unit-tested (door-logic, suite 409):
validateDoorTarget (request host must equal the pinned host;
metadata/link-local always blocked; http(s) only), the
firmware-verified HeatSync encoders with fixed-width zero-padding
(slot 3 / perm 3 / tag 8 / 4-char password), generic template
substitution, and redactDoorSecrets. lib/door/executor.ts is the single
hardened egress: re-validates the pin, refuses redirects, caps time and
body, redacts before any audit write. The door password is read from the
secrets vault and decrypted server-side only, never returned or logged.
/door/manage (door.manage) configures connections, picks a vault secret,
and runs a safe status-only test. Sidebar Admin link added; "Learn"
moved before "People" per request. Docs updated.

docs/ARCHITECTURE.md

@@ -421,7 +421,8 @@ customizable permissions + Ops ACLs, self-change hardening, `026`-`029` custom
 forms + waivers + onboarding form step + per-space form slug + invite roles,
 `030` certifications + Instructor capability, `031` secrets SELECT honors
 `ops.secrets.read`, `032` classes + sessions + signups, `033` equipment +
-reservations).
+reservations, `034` member access cards + door permissions, `035` door
+connections + access log).
 
 ### Forms & waivers (migrations 026-029; complete Phases 1-5)
 
@@ -510,6 +511,28 @@ rule, and the required-certification gate (checked against the normal
 `member_certifications` data; an `equipment.manage` holder gets the
 override and may book on a member's behalf). No anonymous path.
 
+### Door / access control (migrations 034-035; epic in progress)
+
+Phased; P1-P2 built. `member_cards` (034) associates RFID/NFC UIDs to
+members; the UID is a credential (`door.manage`-only RLS, no member SELECT;
+masked count+last4 self-view via a service-client action). `door.manage` /
+`door.operate` permissions (group Access). `door_connections` (035) is a
+per-space controller integration: the shared password is NOT stored on the
+row — `secret_ref` points at the existing AES-256-GCM `secrets` vault and is
+decrypted server-side only. `pinned_host` is the SSRF pin. Pure logic in
+`lib/door-logic.ts` (SSRF `validateDoorTarget`, always-blocked metadata/
+link-local, native HeatSync encoders with the firmware-verified fixed-width
+zero-padding, generic template substitution, secret redaction) is heavily
+unit-tested. `lib/door/executor.ts` is the single hardened egress: it
+re-validates the target against the pin, refuses redirects, caps time and
+body, and redacts secrets before any audit write. `door_access_log` is an
+append-only, secrets-redacted audit with no client write policy (validated
+service-client executor only). `/door/manage` (door.manage) configures
+connections, picks a vault secret, and runs a safe `status`-only test.
+Phase 3 adds live grant/revoke/open and the per-connection member
+self-entry (opt-in, elevated risk, off by default); phases 4-5 add inbound
+log ingest and the universal API-call UI builder. No anonymous path.
+
 ---
 
 ## 13. Known Limitations