docs: module dossier + install/quickstart sync for truthful cutover sprints

- API_CLI_REFERENCE.md, INSTALL_GUIDE.md, quickstart.md, architecture/integrations.md, dev/DEV_ENVIRONMENT_SETUP.md, integrations/LOCAL_SERVICES.md: reflect real-service wiring.
- docs/modules/**: module dossier updates across the modules touched by SPRINT_20260415_001..007 + SPRINT_20260416_003..017 + SPRINT_20260417_018..024 + SPRINT_20260418_025 + SPRINT_20260419_026.
- docs/features/checked/web/**: update feature notes where UI changed.
- docs/qa/feature-checks/runs/web/evidence-presentation-ux/: QA evidence artifacts.
- docs/setup/**, docs/technical/**: align with setup wizard contracts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/modules/registry/architecture.md

@@ -7,7 +7,7 @@ It is designed for offline/self-hosted operation and enforces plan/licence const
 
 The service is intentionally small:
 - One HTTP endpoint: `GET /token`
-- Stateless authorization decisions based on (a) Authority-issued identity token claims and (b) local configuration
+- Authorization decisions based on (a) Authority-issued identity token claims and (b) either persisted or static plan rules
 
 ## Primary responsibilities
 
@@ -35,6 +35,12 @@ The service is intentionally small:
 - Licence revocation uses `stellaops:license` claim and configured `RevokedLicenses`.
 - Plan rules match repositories by wildcard pattern (`*`) and validate requested actions (`pull`, `push`, etc.) as a subset of allowed actions.
 
+**Plan administration storage**
+- The admin `IPlanRuleStore` is backed by PostgreSQL when `RegistryTokenService:Postgres:ConnectionString` is configured.
+- Startup migrations run automatically on host startup for the registry-token schema.
+- The in-memory store is restricted to `Testing` hosts only; live runtime composition requires the durable backend.
+- The persistence schema stores plan rules plus audit history so plan CRUD, audit endpoints, and `/token` authorization survive process restarts.
+
 **Token issuer**
 - Tokens are signed with an RSA private key loaded from `RegistryTokenService:Signing:KeyPath` (PEM or PFX).
 - `aud` defaults to the requested registry `service` value unless `Signing:Audience` is configured.
@@ -81,6 +87,9 @@ Key sections are defined by `RegistryTokenServiceOptions`:
 - `Registry` (realm, allow-listed `service` values)
 - `Plans`, `DefaultPlan`, `RevokedLicenses`
 
+Durable plan-rule persistence is configured separately under `RegistryTokenService:Postgres`.
+When Postgres persistence is configured, the host may start without any statically configured `Plans`; persisted plan rules become the canonical source for admin CRUD and token issuance.
+
 ## References
 
 - Operations/runbook: `docs/modules/registry/operations/token-service.md`