feat: initial architecture specification and research

Phase 0→1 setup for alknet-firewall — a behavioral signal detection
library that screens untrusted LLM inputs using small model activations.

Architecture docs (5 specs, 10 ADRs, 7 open questions):
- overview: vision, scope, dependencies, package structure
- firewall: core API, alarm protocol, score composition, error handling
- codebook: SVD basis, spline distributions, calibration, tensor format
- model: activation extraction, model-agnostic interface, lazy loading
- configuration: thresholds, model selection, detection tuning

Research reports:
- modern-python-project-setup: uv, pyproject.toml, src layout, ruff, CI
- python-ml-packaging: optional PyTorch, HF Hub download, safetensors
- llm-input-safety-landscape: threat taxonomy, defenses, academic evidence

Agent role adaptations for Python project (replaced Rust conventions).

docs/architecture/decisions/001-python-uv.md

@@ -0,0 +1,41 @@
+# ADR-001: Python with uv
+
+## Status
+
+Accepted
+
+## Context
+
+The project needs a programming language and build toolchain. The PoC was
+written in Python using PyTorch, sklearn, and transformers. A Rust port using
+burn/cubecl was attempted but failed — the ML framework ecosystem in Rust is
+not yet mature enough for this type of work.
+
+The project needs a fast path to a usable system. The PoC already works in
+Python. Modern Python packaging (uv, pyproject.toml, src layout) provides a
+professional project structure that was not available even a few years ago.
+
+## Decision
+
+Use Python 3.10+ with uv as the package manager and build tool. Use uv_build
+as the build backend. Use src/ layout for the package.
+
+## Consequences
+
+**Positive**:
+- Fast path to working system — PoC code is already Python
+- Rich ML ecosystem (PyTorch, transformers, sklearn, safetensors)
+- uv provides 10-100x faster dependency management than pip
+- Modern packaging standards (pyproject.toml, PEP 735 dependency groups)
+- Easy distribution via PyPI with `pip install alknet-firewall[torch]`
+- Type checking via mypy provides strong correctness guarantees
+
+**Negative**:
+- Python is slower than Rust for non-ML code (SVD projection, data wrangling)
+- PyTorch is a large optional dependency (200MB-2.5GB)
+- Rust port remains a future goal (Phase 3, speculative)
+
+## References
+
+- [modern-python-project-setup.md](../research/modern-python-project-setup.md)
+- [python-ml-packaging.md](../research/python-ml-packaging.md)