docs: align operator docs with routes, sessions, and restore

Fix architecture route RBAC, restore Resync, and session/password wording;
correct guide restore/session/PTR claims and README port-587 text; point
the CSRF ADR at authz.go for global route gating.

Co-authored-by: Cursor <cursoragent@cursor.com>

CHANGELOG.md

@@ -84,6 +84,16 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ### Changed
 
+- docs: operator and as-built docs aligned with the code after a full
+  pass — [architecture.md](docs/architecture.md) route table now marks
+  **global** routes (404 for domain administrators) and documents the
+  one-time restore Resync; session/password and restore-session wording
+  corrected in [guide.md](docs/guide.md) and architecture (own-password change
+  vs admin reset, no "logout everywhere", immediate session restore, PTR cache
+  ≈1 min, decrypt has no version check); [README.md](README.md) port-587 and
+  quick-start volume wording fixed; [security.md](docs/security.md) CSRF ADR
+  points at `authz.go` for route gating. No behaviour change.
+
 - docs: [guide.md](docs/guide.md) reorganised into **Installation**, **Instance
   administration**, and **Domain administration** — DNS setup, operations,
   rate limiting, and backup sections follow the instance/domain boundary