docs: add UserContext pattern documentation and architecture rules

Documentation:
- docs/architecture/user-context-pattern.md: Comprehensive guide on
  UserContext vs User model, JWT token mapping, common mistakes

Architecture Rules (auth.yaml):
- AUTH-005: Routes must use UserContext, not User model attributes
- AUTH-006: JWT token context fields must be defined in UserContext
- AUTH-007: Response models must match available UserContext data

Architecture Rules (module.yaml):
- MOD-024: Module static file mount order - specific paths first

These rules prevent issues like:
- Accessing SQLAlchemy relationships on Pydantic schemas
- Missing token fields causing fallback warnings
- Response model validation errors from missing timestamps
- 404 errors for module locale files due to mount order

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.architecture-rules/module.yaml

@@ -723,3 +723,41 @@ module_rules:
       file_pattern: "app/modules/*/definition.py"
       validates:
         - "router imports -> get_*_with_routers function"
+
+  # =========================================================================
+  # Static File Mounting Rules
+  # =========================================================================
+
+  - id: "MOD-024"
+    name: "Module static file mount order - specific paths first"
+    severity: "error"
+    description: |
+      When mounting module static files in main.py, more specific paths must
+      be mounted BEFORE less specific paths. FastAPI processes mounts in
+      registration order.
+
+      WRONG ORDER (locales 404):
+        # Less specific first - intercepts /static/modules/X/locales/*
+        app.mount("/static/modules/X", StaticFiles(...))
+        # More specific second - never reached!
+        app.mount("/static/modules/X/locales", StaticFiles(...))
+
+      RIGHT ORDER (locales work):
+        # More specific first
+        app.mount("/static/modules/X/locales", StaticFiles(...))
+        # Less specific second - catches everything else
+        app.mount("/static/modules/X", StaticFiles(...))
+
+      This applies to all nested static file mounts:
+        - locales/ must be mounted before static/
+        - img/ or css/ subdirectories must be mounted before parent
+
+      SYMPTOMS OF WRONG ORDER:
+        - 404 errors for nested paths like /static/modules/tenancy/locales/en.json
+        - Requests to subdirectories served as 404 instead of finding files
+
+      See: docs/architecture/user-context-pattern.md (Static File Mount Order section)
+    pattern:
+      file_pattern: "main.py"
+      validates:
+        - "module_locales mount BEFORE module_static mount"