feat(v5): use bridged Lima hosts for coold dev

Add v5 architecture docs and update dev bootstrap, seeding, and tests to use bridged Lima .local hosts with a container-accessible SSH key.

docs/v5/architecture/responsibility-split.md

@@ -0,0 +1,60 @@
+# v5 Responsibility Split
+
+Use this as the first check when deciding where a new feature belongs.
+
+## Rule of thumb
+
+| Question | Owner |
+| --- | --- |
+| What should happen for this user, team, app, database, or deployment? | Coolify |
+| Which connected host should receive this request? | Coolify chooses, Flux routes |
+| How do we get a command to a NATed host? | Flux |
+| Do this concrete operation on this host. | coold |
+| Is this allowed for this Coolify user/team? | Coolify |
+| Is this host operation dangerous even if Coolify asked for it? | coold deny filter |
+
+## Coolify owns
+
+- Users, teams, roles, RBAC, API tokens, sessions, SSO/OAuth.
+- Projects, environments, applications, services, databases, servers.
+- Resource configuration: source, image, build settings, env vars, domains,
+  ports, health checks, resource limits, volumes, schedules, webhooks.
+- Deployment state machines: pending, building, pulling, creating, starting,
+  health waiting, cutover, running, failed, rollback, cleanup.
+- Placement and scheduling decisions.
+- Proxy/ingress configuration rendering and TLS intent.
+- Secret storage, encryption, resolution, and injection at deploy time.
+- Business audit, event history, deployment logs, and user-facing status.
+- Notifications, billing/subscriptions, cloud-provider integration.
+
+## Flux owns
+
+- Long-lived coold stream registry keyed by host ID.
+- Pending request registry keyed by request ID.
+- Request routing from Laravel's Unix-socket lane to the selected coold stream.
+- Timeouts, disconnected-host responses, pending-cap protection, and late result
+  handling.
+- Host-agent authentication for inbound coold streams.
+
+Flux does not inspect product meaning. `containers.start` is just a frame to a
+host; Flux does not know it is part of an nginx deployment.
+
+## coold owns
+
+- Local Podman access.
+- Host runtime primitives: images, containers, volumes, networks, logs, exec,
+  health checks, host facts.
+- Firewall mutation and reconciliation as the sole kernel firewall writer.
+- Embedded DNS and service-discovery sync.
+- Writing this host's service endpoint rows to Corrosion.
+- Builder subprocess supervision when the host advertises builder capability.
+- Host-level safety checks such as container-create deny filters.
+
+coold does not store Coolify secrets, users, teams, app ownership, deployment
+history, billing data, or business audit.
+
+## Boundary test
+
+If a different orchestrator could reuse the same operation with its own app
+model, it probably belongs in coold. If the operation only makes sense because
+of Coolify's product model, it belongs in Coolify.