Add architecture docs, fix gRPC/REST API parity, project conventions

- Add ARCHITECTURE.md with full system specification
- Add Project Structure and API Sync Rule to CLAUDE.md; ignore srv/
- Fix engine.proto MountRequest missing config field
- Add pki.proto PKIService to match unauthenticated REST PKI routes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/server/server_test.go

@@ -11,6 +11,8 @@ import (
 
 	"log/slog"
 
+	"github.com/go-chi/chi/v5"
+
 	"git.wntrmute.dev/kyle/metacrypt/internal/barrier"
 	"git.wntrmute.dev/kyle/metacrypt/internal/config"
 	"git.wntrmute.dev/kyle/metacrypt/internal/crypto"
@@ -23,7 +25,7 @@ import (
 	"git.wntrmute.dev/kyle/metacrypt/internal/auth"
 )
 
-func setupTestServer(t *testing.T) (*Server, *seal.Manager, *http.ServeMux) {
+func setupTestServer(t *testing.T) (*Server, *seal.Manager, chi.Router) {
 	t.Helper()
 	dir := t.TempDir()
 	database, err := db.Open(filepath.Join(dir, "test.db"))
@@ -61,9 +63,9 @@ func setupTestServer(t *testing.T) (*Server, *seal.Manager, *http.ServeMux) {
 	logger := slog.Default()
 	srv := New(cfg, sealMgr, authenticator, policyEngine, engineRegistry, logger)
 
-	mux := http.NewServeMux()
-	srv.registerRoutes(mux)
-	return srv, sealMgr, mux
+	r := chi.NewRouter()
+	srv.registerRoutes(r)
+	return srv, sealMgr, r
 }
 
 func TestStatusEndpoint(t *testing.T) {