docs: add architecture documentation and slides

docs/adr/002-redis-otp-state.md

@@ -0,0 +1,18 @@
+# ADR 002: Store OTP State In Redis
+
+## Status
+
+Accepted.
+
+## Context
+
+OTP state is temporary, security-sensitive, and must expire automatically.
+
+## Decision
+
+Store only HMAC hashes of OTP codes in Redis, with TTLs, attempt counters, and request rate limits.
+
+## Consequences
+
+OTP verification is fast and self-expiring. Plaintext OTPs are not persisted. The local debug provider writes a separate development-only key for demos.
+