docs: plan HTTPS peers and source install

docs/architecture.md

@@ -78,8 +78,10 @@ provided by a validated control-plane task.
   Raft, and closes SQLite without exceeding the service stop timeout.
 - A web-console failure is reported and causes an intentional process policy;
   it must not silently leave a partially healthy process.
-- Startup rejects malformed `WORKER_URL`, incomplete auth credentials, invalid
-  cluster settings, and unwritable data directories before accepting work.
+- Startup currently rejects malformed `WORKER_URL`; the accepted target is
+  `PUBLIC_URL` with bounded compatibility migration. Startup also rejects
+  incomplete auth credentials, invalid cluster settings, and unwritable data
+  directories before accepting work.
 - `GET /healthz` reports process-local liveness. Control-plane reachability is
   a separate readiness/selfcheck signal and must not make a healthy container
   fail its local liveness probe.