feat: add prelaunch site controls and refresh branding

docs/architecture.md

@@ -42,6 +42,47 @@ provide a persistent writable filesystem and can override the location with
 `TDR_DATABASE_PATH`. This rules out ephemeral serverless filesystems unless a
 persistent volume is attached.
 
+## Site launch controls
+
+The singleton `site_launch_settings` row stores the public launch gate, account
+creation state, and availability for News, Database, Builds, Guides, and
+Builder. Schema migration creates the row with Coming Soon enabled, account
+creation enabled, and all five sections enabled. The application caches the row
+for five seconds and clears the process cache after an operator saves changes.
+
+Agents with `site.settings.manage` edit the row from ISAC → System
+Configuration → Site Controls. The save action requires an explicit value for
+all seven controls and a confirmation token. A successful update records
+`system_configuration / site_access.updated` with the operator, target row, and
+complete before/after snapshots.
+
+The request hook applies the launch gate to anonymous traffic and section
+availability to every request:
+
+- With Coming Soon enabled, anonymous `GET` and `HEAD` requests redirect to
+  `/coming-soon`. Anonymous mutations outside exempt routes receive a JSON 404.
+- Authenticated agents bypass the Coming Soon gate and enter the application.
+- A disabled public section blocks its route family for every user, including
+  authenticated agents: `/news`, `/database`, `/builds`, `/guides`, or
+  `/builder`. `GET` and `HEAD` requests redirect to `/coming-soon` with the
+  unavailable section identified. Mutations receive a JSON 404.
+- Authentication callbacks, sign-in, contact, legal pages, health endpoints,
+  scheduler endpoints, application assets, and the prelaunch page remain
+  reachable without a session.
+
+The global navigation omits disabled sections for every user. Server checks
+remain authoritative for direct URLs and mutations. An authenticated operator
+may open `/coming-soon` to preview the promotional page, but the preview does
+not override section availability.
+
+Account creation uses a separate control. Closing registration blocks password
+registration, a magic-link request for an unknown email, and Discord OAuth for
+an unknown Discord identity. Existing password, email, and Discord identities
+can still sign in. The sign-in page hides the password registration form and
+explains registration closure. This guard runs on the server, so a crafted form
+submission or OAuth callback cannot create an account while registration is
+closed.
+
 ## Increment plan
 
 1. Product shell and anonymous local-draft builder.