Replaces the K-101 placeholder with prescriptive patterns verified
against nexus-hub main: create_app factory + configure_logging order,
Settings/secret-repr, the visibility.py single-query-path with the
architecture test that bans direct selects, router.run as the only LLM
interface (hard guard + LOCAL_ENDPOINT_ALLOWLIST), session auth via
get_current_user/require_admin (404 for member), audit.record whitelist,
PRIV-5 redaction CONTENT_KEYS, alembic autogenerate flow (name
constraints, hand-add triggers/extensions), and the disposable
pgvector/pg16 CI container strategy. Plugin 0.2.0 -> 0.3.0.
