[johnf]

Summary

The README's "How it fits together" section pointed to files that no longer exist, and described file downloads as signed URLs.

- Access control: … (src/auth.ts, src/routes/auth.ts)
- File downloads: short-lived signed URLs … (src/routes/file.ts)
+ Sign-in: the API is its own OIDC provider … (src/oidc/)
+ Access control: every entity is visible, access is by licence via REMS (src/auth.ts)
+ Files and metadata: arocapi's OCFL storage backend serves files; metadata comes from the structural index (src/app.ts)

The arocapi link now points to crate-works/arocapi.

Evidence

• Before: ls src/routes/auth.ts src/routes/file.ts → No such file or directory
  After: every path the section names (src/oidc/, src/auth.ts, src/app.ts) exists

Merge Danger

Door: two-way

Blast Radius: none (docs only)