docs: correct ARCHITECTURE layout/§7, note intentional settings + single-space

Project tree + section 7 module paths now reflect the per-domain
lib/actions/* reality (no monolithic lib/actions.ts); explicit note that
/settings admin secret loading is by-design same-space management;
getAuthMember single-space invariant documented in code. HANDOFF pass-31.

lib/auth-helpers.ts

@@ -43,6 +43,11 @@ export async function getAuthMember(supabase: ServerSupabase): Promise<Member |
   } = await supabase.auth.getUser()
   if (!user) return null
 
+  // INVARIANT: one active membership per user (single-space product model;
+  // see ARCHITECTURE "Known Limitations"). `.single()` is intentional -- if a
+  // user somehow has 2+ active memberships it fails closed (no action runs)
+  // rather than silently picking a space. Multi-space would require an
+  // explicit active-space selector before this can change.
   const { data } = await supabase
     .from('space_members')
     .select('id, space_id, user_id, role, display_name, handle')