docs(arch): say which requests skip the credential-epoch check

[mforce]

docs/architecture.md said the credential-epoch check reads the database on every authenticated request. CredentialEpochMiddleware skips two kinds of request: /api/v1/auth/logout, with or without a trailing slash, and the /error re-execution, which it detects through IExceptionHandlerFeature. The sentence now names both. It also says that a token whose user or account claim does not parse is rejected without a database read.

CredentialEpochFreshReadTests.EveryAuthenticatedRequest_ReadsTheCredentialRowOnce_AndOnlyLogoutIsExempt pins this behaviour.

This is a review finding (P3) on #1126 that arrived after #1126 merged.

Checks at the head: CouplingMatrixRealTreeTests and TenancyDocsFreshnessTests pass 4/4. The SchemaDocsTests image-pin guards and CredentialEpochFreshReadTests pass 11/11 together.

[mforce]

Folded into #1128 at the owner's request.