docs(org): pre-stage A5 living-docs for merged core+server+CLI-admin (item-CRUD/extension TODO)

Pre-stages the A5 living-docs sweep for the already-merged A (relicario-core org
module) + C (relicario-server pre-receive hook) + CLI admin/rotate/status-audit
work, so the final A5 sweep (after Dev-B B9-B14 merges) is fast.

Adds org sections to docs/FORMATS.md (org repo wire formats + wrapped-key blob
layout), docs/CRYPTO.md (ECIES X25519 wrap/unwrap, no-Argon2id contrast, rotate
re-encryption), docs/SECURITY.md (signature-verifying hook, owner-only elevation,
audit vocabulary, honest limitations), DESIGN.md (org-master-key secrets row +
server org mode + deps), core/cli ARCHITECTURE.md (org module + org_session), and
an Unreleased CHANGELOG entry.

B item-CRUD (org add/get/list/edit/rm/restore/purge + main.rs wiring) and extension
parity are left as explicit TODO. STATUS/ROADMAP mark-shipped and
extension/ARCHITECTURE are deferred to the full A5 (track not yet landed; Dev-D
deferred). All cited code constants pinned with file:line per living-docs discipline.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TJo44YM3UbBjro2fG6NrKy

crates/relicario-cli/ARCHITECTURE.md

@@ -71,6 +71,30 @@ under `src/commands/`. Each source file has one job.
   hatches `RELICARIO_TEST_PASSPHRASE` (`session.rs:42`) and `RELICARIO_IMAGE`
   (`session.rs:125`) that integration tests use to bypass the TTY.
 
+- **`src/org_session.rs`** — `UnlockedOrgVault`, the org-vault analogue of
+  `session.rs`. Holds the org master key in `Zeroizing<[u8; 32]>` for one CLI
+  invocation, recovered by unwrapping `keys/<member-id>.enc` with the device
+  ed25519 seed (`relicario_core::unwrap_org_key`). Owns the **collection-scoped**
+  `item_path` (`items/<collection-slug>/<id>.enc` — the leading slug is what the
+  pre-receive hook authorizes against, never decrypting), fingerprint-based
+  member matching (`relicario_core::fingerprint`, tolerant of OpenSSH
+  whitespace/comment differences), `atomic_write`, and `org_git_run`. Note
+  `org_git_run` runs **bare git** — unlike `helpers::git_run` it does NOT inject
+  `commit.gpgsign=false`, because org commits MUST be signed (the hook verifies
+  every commit's signature); signing config is established by
+  `configure_git_signing` during `org init`.
+
+- **`src/commands/org.rs`** — the `relicario org` subcommand surface. Merged:
+  `init`, `add-member` / `remove-member` / `set-role` (owner-only escalation
+  guard), `create-collection` / `grant` / `revoke`, `rotate-key`
+  (`run_rotate_key`, `commands/org.rs:332` — fresh key, re-wrap for all members,
+  re-encrypt every item blob + manifest under the new key, concurrent-rotation
+  abort), and `status` / `audit` (verified-signer attribution + `TAMPERED`
+  flag). **TODO (pending Dev-B B9–B14):** the item-CRUD commands (`org add` /
+  `get` / `list` / `edit` / `rm` / `restore` / `purge`) and the final
+  `Commands::Org` wiring in `main.rs`. `device.rs` gains
+  `current_device_seed` / `current_device_pubkey` helpers for the ECIES unwrap.
+
 - **`src/helpers.rs`** (`helpers.rs:1-101`) — pure, no-state plumbing:
   `find_vault_dir_from` (`helpers.rs:14-28`) walks up parent directories
   looking for a `.relicario/` marker; `vault_dir` and `relicario_dir` wrap it