Sync Repo-docs-MODULE-ARCHITECTURE from project files

Repo-docs-MODULE-ARCHITECTURE.-.md

@@ -1,4 +1,4 @@
-<!-- codex-wiki-sync:0fe10429f2b49107da579c69 -->
+<!-- codex-wiki-sync:0e9ea4738aad52fd7f810ccb -->
 
 > Mirrored from `/mnt/DATA/git/govoplan-core/docs/MODULE_ARCHITECTURE.md`.
 > Origin: `repository`.
@@ -77,15 +77,17 @@ Known access-related capability names are defined in
 - `access.directory`
 - `access.permissionEvaluator`
 - `access.resourceAccess`
+- `access.tenantProvisioner`
 - `tenancy.tenantResolver`
 - `security.secretProvider`
 - `audit.sink`
 
 `govoplan-access` currently registers `access.principalResolver`,
-`access.permissionEvaluator`, and `access.directory`. `govoplan-tenancy`
-registers `tenancy.tenantResolver`. Feature modules should prefer these
-capabilities over direct reads of access/tenant ORM models when they need
-labels, group membership, or tenant metadata.
+`access.permissionEvaluator`, `access.directory`, and
+`access.tenantProvisioner`. `govoplan-tenancy` registers
+`tenancy.tenantResolver`. Feature modules should prefer these capabilities over
+direct reads of access/tenant ORM models when they need labels, group
+membership, default access provisioning, or tenant metadata.
 
 ## Module Responsibilities