docs: add architecture, design spec, and security notes

Analyze the NS App and document what it does: NMI card payments on
Sales Invoices, AutoPay vaulting, multi-invoice settlement, guided
Customer Quick Entry, and branded print formats.

- docs/ARCHITECTURE.md  — functional overview, component map, payment
  flow, data model, dependencies, config, known tech debt
- docs/DESIGN_SPEC.md   — goals, requirements, API contracts, failure
  modes, acceptance criteria
- docs/SECURITY_NOTES.md — posture + hardening list
- docs/README.md        — docs index; link from root README

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/README.md

@@ -0,0 +1,30 @@
+# NS App — Documentation
+
+Reference documentation for the **NS App** ERPNext/Frappe custom application
+(NS Innovations). This app extends the Sales workflow with embedded card
+payments, AutoPay vaulting, multi-invoice settlement, guided customer
+onboarding, and branded print formats.
+
+## Contents
+
+| Document | What's in it |
+|----------|--------------|
+| [ARCHITECTURE.md](./ARCHITECTURE.md) | What the app does, component map, payment flow diagram, data model, external dependencies, configuration, and known tech debt. |
+| [DESIGN_SPEC.md](./DESIGN_SPEC.md) | Goals/non-goals, personas, functional requirements, server API contracts, design constraints, failure modes, and acceptance criteria. |
+| [SECURITY_NOTES.md](./SECURITY_NOTES.md) | Current security posture and a prioritized hardening list. |
+
+## Quick orientation
+
+- **Backend:** `ns_app/api/payments.py` (NMI gateway), `ns_app/api/customer.py`
+  (atomic customer creation).
+- **Frontend:** `ns_app/public/js/sales_invoice.js` (payment UI),
+  `ns_app/public/js/customer_quick_entry.js` (customer quick entry).
+- **Wiring:** `ns_app/hooks.py`.
+- **Print formats:** `ns_app/print_formats/` (shipped as fixtures).
+
+## Related
+
+- Root [README.md](../README.md) — install & configuration guide.
+- `ns_app/api/payment_flow_documentation.md` — original narrative walkthrough of
+  the payment flow (kept for historical context; superseded by
+  [ARCHITECTURE.md](./ARCHITECTURE.md) §3).