Bring ARCHITECTURE.md in line with the security fixes on this branch: unicast-only mDNS candidates and the per-source-IP candidate budget, source-IP binding of change hints, the split 64 KiB request / 8 MiB response frame caps, and the `-ol-` plus link-audit rule for ordinary `.eti` extraction. Claude-Session: https://claude.ai/code/session_017C3Nbgwpdm3YNwZhhFLHwg