[knittingcode]

Summary

The README described implemented authentication features as future work. This brings four lines of README.md in line with main.

Motivation and context

These statements were out of date after FND-010B and FND-010V:

• The per-user API limit is implemented: FCRM-002 NFR-007, 600 requests per minute (backend/config/services.yaml, flowcrm.rate_limit.api_user).
• Rate limits and their locks are stored in PostgreSQL (ADR-007).

The overnight documentation review found the discrepancy (OVN-116).

Changes

Line	Change
Stack	Rate limits and their locks use PostgreSQL, not "will".
Architecture	Authentication now lists the per-user API limit of 600 requests per minute.
Known limitations	No longer lists the per-user API rate limit as future work.
Roadmap	"Implement authentication and authorization" is ticked, because FND-010B (#13) is merged. This tick is a judgement for the owner.

Testing

• Every changed statement was checked against main, not against open PRs.
• CI runs the usual matrix. The branch was updated with main after fix(docker): upgrade brotli-libs for CVE-2026-111497 in the runtime images #18 (merge commit, no force push).
• No code changes.

Security considerations

None. Documentation only.

Known limitations and dependencies

• feat(organizations): membership administration API (FND-010C) #19 rewrites the same "Known limitations" line, so whichever PR merges second gets a textual conflict.
• feat(organizations): membership administration API (FND-010C) #19's line no longer mentions the rate limit, so the two now agree on content. The resolution is feat(organizations): membership administration API (FND-010C) #19's sentence.