Remove platform tenancy from SXCHNGE customer BFF (#34)

docs/architecture/bff.md

@@ -18,8 +18,8 @@ The source checkout's unrelated dependency edits were not copied.
 | Local component | Reused implementation |
 | --- | --- |
 | `backend/edge/shared` | Chi HTTP runtime, middleware, JWT login/pending sessions, refresh/rotation/logout, CSRF/cookies, rate limiting, Mongo verification and refresh-token stores |
-| `backend/edge/product/interface/accountservice` | Account validation, bcrypt passwords, creation, local membership/roles, activation tokens, password reset and email-change token issuance, deletion |
-| `backend/pkg` | Canonical local account/domain models, Mongo repositories/transactions, authorization, errors, structured logging, process bootstrap and health |
+| `backend/edge/product/interface/accountservice` | Account validation, bcrypt passwords, atomic customer creation, activation tokens, password reset and email-change token issuance, deletion |
+| `backend/pkg` | Canonical local account/domain models, Mongo repositories/transactions, errors, structured logging, process bootstrap and health |
 | `backend/internal/profile` | Small SXCHNGE composition layer selecting the copied local account service |
 | `backend/contracts/sendico` | Separate snapshot of Sendico's public OpenAPI contract and its referenced schemas |
 
@@ -29,10 +29,12 @@ private Sendico module requirement, gRPC client, discovery subscription or broke
 connection. Platform engines and Product's platform-provisioning bootstrap were
 not copied. The original handwritten shell and tiny replacement helpers were removed.
 
-The existing local account service retains local organization membership and role
-semantics. Use one SXCHNGE local tenant when wiring registration; this does not
-create an organization in Sendico for each customer. Local database collections,
-JWT keys and registered application clients belong exclusively to SXCHNGE.
+Local customers have no organization membership, roles, policies or tenant ID.
+The account service validates and hashes passwords, creates an account and
+activation token atomically, and deletes an account with session revocation.
+Customer responses map to explicit local DTOs. Account, token and session collections and application client records belong only
+to SXCHNGE. The runtime starts without any policy or tenant seed. Casbin,
+invitations, financial models and provisioning machinery are excluded.
 
 ## Identity and ownership
 
@@ -98,8 +100,9 @@ Sendico task. No private transport fallback is allowed.
 ## Next wiring sequence
 
 1. Wire local signup, verification delivery/completion and profile endpoints onto
-   the copied account and verification services. Create SXCHNGE-owned tenant,
-   client and role records; keep signup independent of Sendico availability.
+   the copied account and verification services. Configure the SXCHNGE application
+   client for web/native sessions; keep signup independent of Sendico availability.
+   Never add local organization, membership, role or policy requirements.
 2. Implement the public HTTP adapter and confirm organization/resource scoping
    with the integration principal. Agree on external-customer contracts where the
    existing public API assumes a Sendico account.
@@ -120,6 +123,6 @@ operation details explain what has happened and what remains pending.
 This task supplies the copied starting point and isolated public contracts.
 The local runtime installs the existing authentication transport and account
 service. Local signup/profile HTTP endpoints, verification delivery/completion,
-initial tenant/client provisioning, Flutter HTTP adapters and live Sendico calls
+application client setup, Flutter HTTP adapters and live Sendico calls
 are not connected yet. The frontend continues using its existing dummy services.
 No new provider organization, customer or payment has been created.