docs: declare institutional architecture boundary

src/govoplan_encryption/backend/manifest.py

@@ -7,6 +7,7 @@ from govoplan_core.core.modules import (
     PermissionDefinition,
     RoleTemplate,
 )
+from govoplan_core.core.provider_governance import declared_module_architecture
 
 
 MODULE_ID = "encryption"
@@ -118,12 +119,22 @@ manifest = ModuleManifest(
                 "explicitly exported, or cryptographically deleted."
             ),
             layer="available",
-            documentation_types=("admin",),
-            audience=("administrator", "security_officer", "product_owner"),
+            documentation_types=("admin", "user"),
+            audience=("user", "administrator", "security_officer", "product_owner"),
             related_modules=OPTIONAL_DEPENDENCIES,
             order=100,
         ),
     ),
+    architecture=declared_module_architecture(
+        layer="institutional_foundation",
+        kind="foundation",
+        maturity="scaffold",
+        documentation_ref="docs/ENCRYPTION_BOUNDARY.md",
+        known_limits=("No production key vault, protected-content persistence, rotation worker, or recovery ceremony is implemented yet.",),
+        owned_concepts=("key vault", "content-protection envelope", "cryptographic recovery ceremony"),
+        non_owned_concepts=("domain content", "resource ownership", "account authentication"),
+        security_docs=("docs/ENCRYPTION_BOUNDARY.md",),
+    ),
 )