feat(isac): add moderated data contributions

docs/architecture.md

@@ -107,6 +107,27 @@ mutation rather than deletion or modification of the original event:
    administrative access.
 6. The server restores the previous state and appends an `audit.reverted` event
    whose target is the original audit-event ID.
+
+# Moderated game-data contributions
+
+ISAC data access is split into `data.view`, `data.propose`, `data.manage`, and
+`data.approve`. Data Viewers can inspect registries. Data Contributors can submit
+the same editor forms, but the request is serialized into `data_change_proposals`
+instead of mutating canonical tables. Data Approvers review the queue and must
+explicitly confirm approval or rejection.
+
+Approval replays the stored form through its original SvelteKit server action.
+This preserves canonical validation, relational updates, icon processing, and the
+normal game-data audit event. Proposal creation and review decisions also produce
+separate `data_moderation` audit events. Failed canonical validation marks a
+proposal as failed without changing live data. Pending counts appear alongside
+each data registry in ISAC so collaborators can see concurrent suggestions.
+
+The protected seeded roles are Data Viewer, Data Contributor, Data Editor, and
+Data Approver. Data Editor retains direct-write access for trusted operators;
+Data Approver combines direct-write access with queue review. New ISAC data
+modules must use the shared moderation interception path and audit both the final
+mutation and proposal lifecycle.
 7. A successfully reverted event cannot be reverted again.
 
 Unsupported destructive identity operations, account deletion, incomplete