install wardrowbe on orion

docs/design.md

@@ -23,6 +23,10 @@ LAN SSH on Polaris, and laptop power/firmware management on Zenith, are delibera
 Orion owns shared services. Tailnet administration supplements existing access;
 public Orion SSH closes only after private access is verified. Web services stay public.
 
+Wardrowbe uses a password gateway for trusted household access, followed by profile
+selection inside the app; verified individual identity is deferred. Its internal AI
+is disabled. Paid API usage, a Codex bridge and local model integration are deferred.
+
 Nix owns reproducible installation, integration and selected settings. Applications
 own credentials, sessions, content and deliberately interactive preferences. No
 plaintext secrets enter Git, Nix evaluation or store outputs. Company credentials