done -> work/artifacts/F-006/documenter.md

# F-006 — Documentation

Agent: documenter
Stage: document
Feature: F-006

## Updated

- `project/README.md`:
  - Authentication table: register/login responses now include `role`.
  - New section "Users and RBAC (users module)": endpoint table with access
    rules, 401/403/404 semantics, anti-enumeration note, SQL scoping note,
    `GET /users` listing semantics, and the injected-`Authenticate` boundary
    contract.
  - Layout: `users/` module added to the tree.
  - HTTP contract: auth codes now include `UNAUTHORIZED` (401) and
    `FORBIDDEN` (403).
- Specs `specs/F-006-users-rbac/` (SPEC/DESIGN/TASKS/TESTS) were authored in
  the design stage and match the delivered implementation, except the
  documented deviation noted in `work/artifacts/F-006/implementer.md`
  (ownership unit tests merged into `shared/tests/auth.test.ts`).

## Not needed

- `spec/tech.md`: no new dependencies this ticket.
- `spec/roadmap.md`: F-006 already listed in Wave 1; no status field tracked
  there.