docs: feature - reverse-engineering & code-forward architecture

[devin-ai-integration]

Summary

Adds docs/architecture/reverse-engineering-and-code-forward.html — a self-contained (inline CSS + Mermaid 10) architecture document produced by the "Reverse-Engineering & Code-Forward Architecture" playbook against commit 7998b9b, plus the five rendered figures under docs/architecture/figures/. No application code, build file or schema is changed; this is documentation only, derived from read-only source inspection (no build/test/run executed).

Sections 2–5 are observed (each row cites file:line), 6–7 are proposed:

• deployment diagram + data-ownership table (writer/reader per table)
• 12 business rules as implemented, account-creation sequence diagram
• external-boundary diagram + integration table (Feign/Axon/SMTP/gateway)
• 12 findings + README cross-check (confirmed / differs / not found)
• target context map (7 nodes), design rules, target ownership map
• 6-slice strangler roadmap with "done when" tests (0/6 complete)

Top findings (details and citations in the document):

1. account-service → customer-service Feign call targets GET /bank/intern/verify/{id}, which no controller serves; every error collapses to CustomerNotFoundException, so account creation cannot succeed at this commit. account-service also posts notifications to /bank/mailing/send while notification-service serves /bank/notifications/send.
2. No table has two writing modules and there is no shared Maven module, but person identity is persisted independently by customer, user and the account projection with no synchronising event; contracts are duplicated by copy (NotificationRequestDTO ×3, JWTAuthorizationFilter ×3).
3. Time and money are unmodelled (LocalDateTime.now() at the REST edge copied into events; BigDecimal with no scale/currency on operations/transfers), transfers are two commands with a plain compensating credit, and security is per-service copy-paste (no auth at gateway, notification-service has no security dependency).

Figures

Verification

• Served with python3 -m http.server 8090, rendered through the existing browser (CDP localhost:29229): document.querySelectorAll('.mermaid svg').length === 5, no "Syntax error" element.
• Printed to A4 PDF: 5 pages.
• All classes/files cited in the findings table verified to exist in the repo at this commit.
• Frontend recording: not applicable (no application code changed).

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/8504526a75614457bfa76fd470e64968
Open in Devin Desktop: https://app.devin.ai/desktop/session/8504526a75614457bfa76fd470e64968?variant=devin
Requested by: @patrickbradley-cog

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring