docs: define CardDAV credential deletion

docs/ADDRESS_MODULE_ARCHITECTURE.md

@@ -148,7 +148,12 @@ a conflict instead of silently overwriting remote data. The first conflict
 review UI compares stored local and remote field payloads and can apply a
 stored remote vCard payload or a manual per-field local/remote merge payload.
 Source disconnect/delete removes the source binding and related sync records
-while keeping local contacts.
+while keeping local contacts. Because API-managed CardDAV credentials are
+encrypted in the source row, the same transaction physically removes their
+ciphertext and emits non-secret credential-deletion audit evidence. Destructive
+module retirement audits all remaining owned credential material before table
+removal. An unowned legacy reference is detached rather than passed to an
+external secret provider.
 
 ## Connector Direction