docs(work): archive shipped template epics and PRDs

Move the 8 shipped template epics and their 9 PRDs (incl.
coverage-architecture) to docs/work/archive/{epics,prds}/ so dispatch
context and prioritization only see live Veect work. The state builder
already walks docs/work/epics/ + docs/work/prds/ only; the one work-CLI
script that matched archive paths (bump-updated-timestamps.mjs, staged
docs/work/**/*.md) now excludes docs/work/archive/ so archived content
stays byte-identical.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK

docs/work/archive/epics/security-headers-rate-limit-sbom/_epic.md

@@ -0,0 +1,33 @@
+---
+id: security-headers-rate-limit-sbom
+prd: docs/work/prds/security-headers-rate-limit-sbom.prd.md
+title: Security headers + rate-limit primitive + SBOM in CI — Epic C of ADR-025
+type: epic
+status: done
+features:
+  [core-shared, core-testing, core-eslint, auth, web-next, web-tanstack, cms]
+created: 2026-05-20T00:00:00Z
+updated: 2026-05-20T11:49:44.873Z
+---
+
+## Goal
+
+Ship three hardening primitives — framework-agnostic security header middleware, a manifest-declared rate-limit conformance channel, and per-release SBOM evidence — so downstream consumers get compliant default headers, lint-enforced rate-limit gates, and CycloneDX audit artifacts without inventing any of them.
+
+## Why
+
+Security scanners flag the absence of HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and CSP on every template app response. Auth endpoints (signIn, signUp) ship without rate-limit declarations, leaving credential-stuffing windows open until a consumer notices their auth logs. Consumers pursuing SOC 2 / ISO 27001 / FedRAMP must invent SBOM tooling and bolt it into their release flow. ADR-025 settled the strategy; this epic is the implementation.
+
+## Stories
+
+- [x] [01 — Rate-limit type primitives and manifest field](01-rate-limit-type-primitives/_story.md)
+- [x] [02 — Rate-limit implementations: Noop, InMemory, Recording](02-rate-limit-implementations/_story.md)
+- [x] [03 — `no-undeclared-rate-limit` ESLint rule](03-no-undeclared-rate-limit-eslint-rule/_story.md)
+- [x] [04 — `withRateLimit` wrapper and conformance extensions](04-with-rate-limit-wrapper-and-conformance/_story.md)
+- [x] [05 — auth.signIn rate-limit backfill](05-auth-signin-rate-limit-backfill/_story.md)
+- [x] [06 — Security headers core module](06-security-headers-core-module/_story.md)
+- [x] [07 — Per-framework security header adapters](07-security-header-adapters/_story.md)
+- [x] [08 — App wiring: web-next](08-app-wiring-web-next/_story.md)
+- [x] [09 — App wiring: web-tanstack and cms](09-app-wiring-web-tanstack-and-cms/_story.md)
+- [x] [10 — SBOM CI workflow and ADR-023 amendment](10-sbom-ci-workflow/_story.md)
+- [x] [11 — Documentation and conformance reference updates](11-documentation/_story.md)