Organize local infrastructure and Vault secrets by service ownership

docs/implementation.md

@@ -705,3 +705,41 @@ were restored and temporary BFF/frontend containers removed. `make up` exits at
 the intentional missing-Resend check, with infrastructure healthy. Backend and
 frontend code did not change in this revision; their earlier test/lint results
 and supplementary legacy test limitations above still apply. No email was sent.
+
+### Organized infrastructure and Vault ownership
+
+This revision supersedes the earlier local Nginx/Vault-certificate arrangement.
+Local Compose, runtime configuration, startup scripts and verification now live
+under `infra/local/`, grouped by service and responsibility. Dockerfiles live in
+`infra/images/`; the root Make targets remain the entry point. Product source
+stays in backend/frontend. Generated state remains in ignored `.local/dev/`.
+
+Vault KV now contains `services/bff/jwt`,
+`services/notifications/callers/bff`, `services/notifications/email/resend`,
+`infrastructure/nats/auth` and `bootstrap/mongo`. Dynamic database credentials
+remain in the database engine. Migration copies with CAS protection, compares
+existing values, archives readable old versions and metadata privately, and then
+removes old flat/TLS KV entries. Conflicting destinations stop migration without
+removing sources. Policies and Agent templates reference only the new paths.
+The unused existing PKI mount is retained to avoid destroying its signing key;
+new bootstrap neither creates nor uses it.
+
+Caddy replaces Nginx, serving Flutter and proxying `/api` to BFF. Caddy owns browser
+certificates and its CA in persistent volumes; only its public CA is exported to
+`.local/dev/ca.pem`. Existing browser trust must be updated to that new CA. Local
+BFF-to-notifications uses plaintext authenticated gRPC. Optional explicitly
+configured TLS remains available in the reusable client/server; incomplete TLS
+configuration is rejected. No local service consumes TLS secrets from Vault.
+
+Validation passed: `make build`, `make test`, `make lint-backend`,
+`make test-dev-tooling`, `make test-dev-infra`, and Compose/diff checks. Tests cover
+plaintext caller-token transport, optional verified TLS, invalid certificate
+configuration and secret migration conflicts. The existing Vault was migrated
+and canonical paths/absence of old entries verified. An isolated fresh project
+passed transaction/lease checks and repeated bootstrap; disposable volumes and
+state were removed. The final rotation check also verified Caddy static serving,
+SPA fallback and API health, then three pool replacements with unchanged BFF PID
+and 1,083 expected HTTP responses, zero failures. Role TTLs were restored and
+temporary BFF/frontend containers removed. `make up` intentionally stops at the
+missing Resend credential check; no real email, optional security scan or merge
+was performed. Earlier supplementary legacy test limitations remain recorded.