docs: update documentation to OKF v0.1 format

docs/architecture/overview.md

@@ -64,16 +64,23 @@ Browser  ──HTTPS──▶  NestJS process (PORT, default 3000)
    attaches the CSRF header on unsafe methods and the Bearer access
    token on every request.
 2. `provideRouter(APP_ROUTES, withComponentInputBinding())`.
-3. `AppComponent.ngOnInit()` calls `BootstrapService.load()` which
-   fetches `GET /api/v1/bootstrap` and applies the returned theme tokens
-   to CSS custom properties on `document.documentElement`.
+3. `AppComponent.ngOnInit()` calls `BootstrapService.load()` then
+   `AuthService.restoreSession()`. Bootstrap fetches `GET /api/v1/bootstrap`
+   and applies the returned theme tokens to CSS custom properties on
+   `document.documentElement`. Session restore rehydrates the in-memory
+   auth signals from `sessionStorage` and posts `POST /api/v1/auth/refresh`
+   with `withCredentials: true` so a hard refresh does not log the user out.
+4. Guards (`authGuard`, `adminGuard`) are async and `await`
+   `BootstrapService.ready()` + `AuthService.waitUntilHydrated()` before
+   reading state, so refreshing on a deep link never flashes `/bootstrap`
+   or `/login`.
 
 # Cross-cutting concepts
 
 | Concern        | Backend                                              | Frontend                                    |
 |----------------|------------------------------------------------------|---------------------------------------------|
-| Authentication | `JwtAuthGuard` (global) + `AuthGuard('jwt')` strategy | `AuthService` signal + `authInterceptor`    |
-| Authorization  | `AdminGuard` + `@Roles('admin')` decorator          | `authGuard` for `/`, `adminGuard` for `/admin` (delegates to pure `decideAdminGuard`) |
+| Authentication | `JwtAuthGuard` (global) + `AuthGuard('jwt')` strategy | `AuthService` signal + `authInterceptor`; session is mirrored to `sessionStorage` and rehydrated on boot via `/api/v1/auth/refresh` |
+| Authorization  | `AdminGuard` + `@Roles('admin')` decorator          | `authGuard` for `/`, `adminGuard` for `/admin` (both async, both delegate to pure decision functions: `decideAuthRedirect` / `decideAdminGuard`) |
 | CSRF           | `CsrfMiddleware` (skips `/api/v1/auth/login` and `/api/v1/auth/register-first-admin`) | `csrfInterceptor` reads `csrf` cookie |
 | Errors         | `ApiError` → `GlobalExceptionFilter` returns `{code, message, details, path, timestamp}` | Components display `error?.error?.message` |
 | Config         | `envSchema` (zod) + `validateEnv`                     | None (consumed via bootstrap)              |