chore: remove references to plugin sdk ARCHITECTURE.md

src/backend/plugins/ctx.ts

@@ -12,7 +12,7 @@
  *   - It does NOT contain malicious code. A plugin runs in the server process
  *     and can import any module core can. Guarding ctx does not change that,
  *     and this file does not pretend otherwise. Trust comes from signing,
- *     review and the kill list. See ARCHITECTURE.md.
+ *     review and the kill list.
  *
  * The actor never comes from plugin code. It comes from AsyncLocalStorage,
  * set by a request or by ctx.asUser, so a plugin cannot name a user and be

src/backend/plugins/loader.ts

@@ -9,7 +9,7 @@
  *
  * What that means honestly: a plugin has the same reach as core. The
  * capability gate on ctx makes privileged calls declared and auditable, not
- * impossible. See ARCHITECTURE.md.
+ * impossible.
  */
 
 import crypto from "node:crypto";

src/backend/tests/plugins/ctx-db.test.ts

@@ -1,9 +1,8 @@
 /**
  * ctx.db and the kv caps.
  *
- * db:own was in the catalog from A1 but nothing checked it, which ARCHITECTURE
- * calls the anti-pattern outright. These assert that it is checked where the
- * privileged thing happens, and audited either way.
+ * db:own was in the catalog from A1 but nothing checked it. These assert that
+ * it is checked where the privileged thing happens, and audited either way.
  */
 
 import { beforeEach, describe, expect, it, vi } from "vitest";