Zwiscshenstand - laufende Version

docs/ARCHITECTURE.md

@@ -7,6 +7,11 @@ Layers
 - Adapters/HTTP: `backend/src/routes/*` map HTTP <-> use-cases and validate inputs.
 - Infra/Services: encryption, email, sync components, logger.
 
+Database Ownership
+- Canonical core schema lives in `backend/src/config/secureDatabase.ts` (users, employees, skills + junctions, language_skills, specializations, controlled_vocabulary, system_settings, security_audit_log). These include field encryption and hash indexes.
+- Extended, non-sensitive schema lives in `backend/src/config/database.ts` (profiles + facets, workspaces/bookings, analytics, organizational structure, deputies, reminders, audit_log).
+- Initialization order: `initializeSecureDatabase()` runs before `initializeDatabase()`. Routes import `db` from either module, but both resolve to the same secure DB instance.
+
 Security
 - JWT required; in production `JWT_SECRET` must be set.
 - Field-level encryption (AES) for sensitive data + deterministic hashes for lookups.