docs: generate + verify project documentation — canonical docs, per-package READMEs, verified fix pass

- New: docs/ARCHITECTURE.md, docs/GETTING-STARTED.md, docs/DEVELOPMENT.md,
  docs/TESTING.md, docs/CONFIGURATION.md (colored mermaid diagrams, quoted labels)
- Regenerated README.md (arah² / arah2bot naming, canonical clone URL)
- New per-package READMEs: theme/, bot/, web/
- Verified 13 docs against the live codebase (2 fix iterations + 2 residual
  corrections); corrected 56 stale claims across AGENTS/DESIGN/IDEAS/GSD_FIX

docs/TESTING.md

@@ -283,7 +283,7 @@ Structural claims — "no menu surface exists", "copy lives only in `strings.ts`
 - `web/test/no-storage.test.mjs` GEO3 — no banned storage token appears in `web/src` code.
 - `web/test/session.test.mjs` SESS4, `web/test/theme.test.mjs` PX02 case 3 — same shape.
 
-**Every one of these gates strips comments first.** The convention is two replaces, repeated verbatim across files:
+**The `web/` gates strip comments first; the three `bot/` gates do not.** `bot/test/commands.test.mjs` CS4 and `bot/test/privacy.test.mjs` PG1/PG2 read raw `readFileSync(file, "utf8")` and match lines directly, with no `replace(` anywhere in `bot/test`. In `web/`, the convention is two replaces, repeated verbatim across files:
 
 ```js
 const code = src
@@ -291,7 +291,7 @@ const code = src
   .replace(/(^|[^:\\])\/\/[^\n]*/g, "$1");    // line comments (skips URLs)
 ```
 
-The reason is documented in `no-storage.test.mjs`: `web/src/mock/telegram-mock.ts` documents the storage ban *in prose*, and prose is not a call site.
+The reason the `web/` gates strip is documented in `no-storage.test.mjs`: `web/src/mock/telegram-mock.ts` documents the storage ban *in prose*, and prose is not a call site.
 
 ### 4. Build-artifact gates (assert on the shipped bundle)