feat: add membership provenance and rules

docs/ARCHITECTURE.md

@@ -4,9 +4,9 @@ How `recoll-modern` is built today. Update in the same commit as any structural
 
 ## Overview
 
-The Python service scaffold, SQLite schema, collection repository, and document discovery/identity
-modules are built. The API, job queue, and Recoll adapter remain intended structure. Recoll behaviour
-below was verified against a real container.
+The Python service scaffold, SQLite schema, collection and membership repositories, and document
+discovery/identity modules are built. The API, job queue, and Recoll adapter remain intended structure.
+Recoll behaviour below was verified against a real container.
 
 The goal: a self-hosted service that wraps Recoll's indexing and full-text search behind (a) a modern
 web UI and (b) an MCP server, running in Docker, with several independent collections such as
@@ -22,6 +22,8 @@ web UI and (b) an MCP server, running in Docker, with several independent collec
 | `src/recoll_modern/` | Python service package; configuration, application factory and CLI boundary |
 | `src/recoll_modern/indexing/` | Root-relative path policy, read-only discovery, stable file hashing |
 | `src/recoll_modern/storage/` | SQLite migrations, collection metadata and content-hash identity |
+| `src/recoll_modern/domain/membership.py` | Validates sources and applies direct additions and rule changes |
+| `src/recoll_modern/indexing/reconcile.py` | Refreshes persistent directory rules while retaining excluded or unreadable files as present |
 | `tests/` | Automated service tests |
 
 Discovery produces content hashes and root-relative paths without writing to the document volume.