docs: fix audit-found drift (status enum, env, limitations, action layout)

Audit follow-up. ARCHITECTURE: status now 'In production', authoritative
note that server actions are per-domain under lib/actions/* (no monolithic
lib/actions.ts), rewrote stale Known Limitations (test suite exists;
PayPal sync route; social auth wired; webhooks signing-only; single-space
assumption), fixed env table (removed phantom SUPABASE_JWT_SECRET, added
SECRETS_ENCRYPTION_KEY/OAuth). DATABASE_SCHEMA/DB_SCHEMA_MAP: ~43 tables /
migrations through 038; space_members.status is member_status enum default
'unverified' (was wrongly 'active'); fixed the active/pending flow text.
README: webhook wording matches WEBHOOKS.md. API_REFERENCE: real
lib/actions/* path + 4 previously-undocumented actions. createSecret docs
were already correct (ADMIN_ROLES = admin+board) -- left as-is.

DB_SCHEMA_MAP.md

@@ -62,7 +62,7 @@
 | `email` | text | nullable |
 | `handle` | text | nullable |
 | `phone` | text | nullable |
-| `status` | text | default `'active'` |
+| `status` | member_status enum (`current`,`late`,`inactive`,`unverified`) | default `'unverified'`; "active" = `current`/`unverified`/`late` |
 | `payment_status` | text | nullable |
 | `payment_note` | text | nullable |
 | `joined_at` | timestamptz | |
@@ -301,7 +301,7 @@ Default channels created by trigger on space INSERT: `general`, `announcements`,
 ### Login
 1. `/login` → `signIn(email, password)` → Supabase auth
 2. Middleware checks session cookie
-3. App layout RSC calls `getCurrentMembership()` → queries `space_members` WHERE `user_id = auth.uid()` AND `status IN ('active', 'pending')`
+3. App layout RSC resolves the member → queries `space_members` WHERE `user_id = auth.uid()` AND `status IN ('current','unverified','late')` (the `ACTIVE_STATUSES` set in `lib/permissions.ts`)
 4. If no membership found → redirect `/signup`
 
 ### Dashboard