Update architecture baseline for sync, sharing, and gateways

docs/threat-model.md

@@ -14,6 +14,7 @@
 - Drive to the existing OnlyOffice Document Server.
 - Public-link visitors to explicitly shared resources.
 - Read-only importer mounts to managed Drive storage.
+- Future WebDAV/rclone credentials to an explicitly granted Drive subtree and action set.
 
 ## Primary threats
 
@@ -21,6 +22,7 @@
 - Session theft, CSRF, credential guessing, token leakage, and proxy-address spoofing.
 - Path traversal, symlink following, MIME confusion, malicious previews, and archive expansion.
 - SSRF or forged OnlyOffice callbacks.
+- Over-broad, leaked, or revoked integration credentials and protocol gateways that bypass application services.
 - Stale writes, duplicate requests, interrupted commits, and premature GC.
 - Secret disclosure through logs, images, configuration, backups, or repository history.
 
@@ -31,6 +33,6 @@
 - Non-root container, explicit mounts, private PostgreSQL network, and health endpoints.
 - Architectural boundaries prevent HTTP code from reaching database or managed storage directly.
 - Security headers, CSRF, authentication, rate limits, scoped tokens, and callback validation are implemented with their Phase 1 features.
+- Phase 1 credentials are independently revocable and may be restricted by subtree and action; future gateways must use them and the canonical mutation path.
 
 Review this document whenever a new external integration, public endpoint, preview processor, or authentication mechanism is introduced.
-