docs(builder): phase 8 — modules, architecture and reference

Twenty pages completing the tree section 10 planned: Modules (8), Architecture
(5) and Reference (7). Four decisions, D38-D41, recorded in PLAN.md section 10.

D39 is the one that shaped the phase. Section 1 forbids re-specifying a
contract, and a Reference section is exactly where that rule is most tempting to
break, so the line is drawn at names: every environment variable, config key,
installer command, visibility rung and canonical document is listed with one
terse line saying what it is FOR, while shapes, semantics and every "why" stay
in the canonical document.

That is only safe because the names are checked. checkReference.mjs compares six
enumerations against the repositories that own them, over the Gitea API, as set
comparisons in BOTH directions -- and the second direction is the one that earns
its keep, because a reference page does not usually rot by describing something
that vanished, it rots by quietly not mentioning what was added since.

The check went green on its first run, which is the least trustworthy possible
outcome, so it was verified by breaking it: seven mutations, all caught. The one
worth keeping is the visibility ladder REORDERED with its membership unchanged
-- it is a security boundary, and a set comparison alone would have passed it.

D41 turns plannedSidebar from a checklist into a checked invariant, and finding
out why was the phase's first defect: it had already drifted, because phase 7
added the Content page under D37 and never updated the list. Nothing failed,
because nothing read it. checkSidebar.mjs now asserts the two trees agree on
groups, labels and order -- order because the order of Getting started IS the
installation path.

Two more things the writing found. PLAN.md's page count was wrong and had been
since section 10 was written ("roughly 38, 37 planned" for a tree of forty).
And module.json's `mounts` and the SPA's paths are different mechanisms that no
single document stated plainly -- module-uo declares admin: ["/shard",
"/uo-link"] while its screen lives at /admin/uo/link, because API routes are
deliberately NOT namespaced while SPA routes are. That is precisely the
distinction the installer got wrong in v0.1.0, and it now has a named home.

D40: the docs link to /architecture/'s drawn diagrams rather than importing
them. Those components carry marketing chrome and depend on diagram.css, which
Starlight does not load; the docs use text diagrams, which paste into an issue.

npm run verify green: 40 pages across 5 groups agree with plannedSidebar, 2390
internal links resolve, 123 repository links point at a branch, 19 facts, 59
quickstart checks, 22 reference enumerations, astro check 0 errors, 36 tests.

Co-Authored-By: Claude <noreply@anthropic.com>

src/config/sidebar.mjs

@@ -44,12 +44,54 @@ export const docsSidebar = [
       { label: 'Troubleshooting', slug: 'docs/administration/troubleshooting' },
     ],
   },
+  {
+    label: 'Modules',
+    items: [
+      { label: 'The module system', slug: 'docs/modules/the-module-system' },
+      { label: 'Installing modules', slug: 'docs/modules/installing-modules' },
+      { label: 'Module lifecycle', slug: 'docs/modules/module-lifecycle' },
+      { label: 'The module manifest', slug: 'docs/modules/the-module-manifest' },
+      { label: 'The module API', slug: 'docs/modules/the-module-api' },
+      { label: 'Building a module', slug: 'docs/modules/building-a-module' },
+      { label: 'The Integration Kit', slug: 'docs/modules/the-integration-kit' },
+      { label: 'Testing and release', slug: 'docs/modules/testing-and-release' },
+    ],
+  },
+  {
+    label: 'Architecture',
+    items: [
+      { label: 'System architecture', slug: 'docs/architecture/system-architecture' },
+      { label: 'The bridge', slug: 'docs/architecture/the-bridge' },
+      { label: 'Authentication architecture', slug: 'docs/architecture/authentication-architecture' },
+      { label: 'Teams architecture', slug: 'docs/architecture/teams-architecture' },
+      { label: 'Protocol versions', slug: 'docs/architecture/protocol-versions' },
+    ],
+  },
+  {
+    label: 'Reference',
+    items: [
+      { label: 'Environment variables', slug: 'docs/reference/environment-variables' },
+      { label: 'Installer CLI', slug: 'docs/reference/installer-cli' },
+      { label: 'sidecar.toml', slug: 'docs/reference/sidecar-toml' },
+      { label: 'Bridge.cfg', slug: 'docs/reference/bridge-cfg' },
+      { label: 'HTTP API', slug: 'docs/reference/http-api' },
+      { label: 'Event catalog', slug: 'docs/reference/event-catalog' },
+      { label: 'Canonical documents', slug: 'docs/reference/canonical-documents' },
+    ],
+  },
 ];
 
 /**
- * The full planned tree, kept next to the live sidebar so phases 7 and 8 have their
- * checklist in the place they will be working. Not exported into the Starlight config —
- * it names pages that do not exist yet.
+ * The tree §10 planned, kept as the record of what was intended — every page it names now
+ * exists, as of phase 8.
+ *
+ * It was the phases 7/8 checklist, and a checklist with nothing left on it is no longer
+ * pulling its weight: it is a second copy of the tree above, maintained by hand, and it had
+ * already drifted once (phase 7 added `Content` under D37 and this list was not updated,
+ * which nothing caught because nothing reads it). `checkSidebar.mjs` now asserts the two
+ * agree, which is what makes keeping it safe.
+ *
+ * Not exported into the Starlight config.
  */
 export const plannedSidebar = {
   'Getting started': [
@@ -65,6 +107,7 @@ export const plannedSidebar = {
     'Configuration',
     'Branding and theming',
     'Navigation and pages',
+    'Content',
     'Users and roles',
     'Authentication',
     'Teams',