Add auth bootstrap and database safeguards

docs/architecture.md

@@ -45,3 +45,41 @@ persistent volume is attached.
 5. Publishing, discovery, ratings, comments, favorites, and copy flow.
 6. Rich build guides and moderation.
 7. Admin editors, validation, audit log, and data import/export.
+# Administrator bootstrap
+
+The first successfully authenticated user is promoted to `admin` if the
+database does not contain an administrator. Promotion uses one conditional
+database update so concurrent first sign-ins cannot both become administrators.
+Once an administrator exists, later sign-ins never alter roles.
+
+# Database backup and restore
+
+Embedded Turso databases contain contributor-entered source data and must be
+preserved across development changes.
+
+Create a timestamped development backup:
+
+```sh
+npm run db:backup
+```
+
+Create a production backup:
+
+```sh
+npm run db:backup:production
+```
+
+The scripts write versioned JSON documents beneath `data/backups/` by default.
+That directory is ignored by Git because backups contain private user data,
+including password hashes.
+
+To restore, first create an empty database and apply the schema. Then run:
+
+```sh
+npm run db:restore -- data/backups/<backup-file>.json
+```
+
+The restore operation refuses to import into any database containing records.
+This guard prevents accidental merging or overwriting of contributor data.
+Stop the application before backup or restore so the embedded database file is
+not locked by another process.