docs, comments: the drift the audit listed (audit 2026-10-17, stage 6)

The lines under "Doc and comment drift" that the findings' own commits
did not already fix:
- security.md: a newer confirmation link replaces the older, a reset link
  is not replaced; html/template renders every page (no themes); the
  container keeps eight capabilities, named, not "KILL".
- architecture.md: ImportKey writes over a name's key, as an import must;
  the error text reaches the browser on the Backup page's import refusal.
- guide: with Caddy the key is in Caddy's data, so a full backup refuses
  until certs/ holds a copy (or back up caddy-data).
- comments: sasldb2 holds application passwords in the clear (store,
  app/password.go); texthash folds ASCII (sender.go); the supervisor
  socket's group is supervisor (rpc.go); cert-reload's OpenSSL measurement
  was 3.0.x of bookworm; sendReset's limits (links.go).
Migration 0013's comment stays as shipped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security-audit-2026-10-17.md

@@ -855,8 +855,11 @@ the argument.
   M6, M8 in code (a session from a longer window is cut at the next check;
   three headers signed; a long header line logged); A6, A7, W7 by wording
   in security.md - each is what the code should do; the README note.
-- [ ] **Doc drift sweep** — every line under "Doc and comment drift" above.
-  — **Sonnet**, 1 h.
+- [x] **Doc drift sweep** — every line under "Doc and comment drift" above.
+  — **Sonnet**, 1 h. *Done 2026-10-17:*
+  every line, each with the finding that fixed it or in this sweep; left as
+  history: migration `0013`'s comment (a migration is not edited after it
+  shipped); the live compose is re-copied at the next rollout.
 - **Accept, with the argument:** *the setuid/setgid binaries of the base
   image* — inert under `no-new-privileges`, which the shipped compose sets
   and the e2e exercises; removing Debian's set is a maintenance cost at every