docs(FN-011): complete Step 8 — update architecture and development docs

Fusion-Task-Id: FN-011
Fusion-Task-Lineage: 4a9aca6f-9d91-43aa-8d2a-d59657c1541a

docs/development.md

@@ -175,3 +175,23 @@ pnpm build
 - **Frontend**: React functional components, TypeScript strict mode, ESLint + Ruff-like rules.
 - **Backend**: FastAPI, Pydantic settings, pytest, ruff, mypy.
 - **Commits**: Conventional commits with task ID prefix, e.g. `feat(FN-002): description`.
+
+## Git Abstraction
+
+The `app/git/` package in the backend provides provider-independent Git
+orchestration. It is split into two layers so that remote provider API logic
+and local CLI operations evolve independently:
+
+| Module | Responsibility |
+|--------|--------------|
+| `types` | Enumerations (`ProviderKind`, `CredentialKind`, `ConnectionStatus`, `SshKeyStatus`) |
+| `provider` | Abstract `GitProvider` — remote operations (`validate_connection`, `list_repositories`, `create_deploy_key`, …) |
+| `credentials` | `GitCredential` / `AccessTokenCredential` models and `CredentialStorage` ABC |
+| `ssh_key` | `SshKeyPair` model and `SshKeyLifecycle` (Ed25519 generation via `cryptography`) |
+| `connection` | `RepositoryConnection` ORM mapping and `ConnectionManager` orchestration |
+| `operations` | Abstract `GitOperations` and concrete `LocalGitOperations` (subprocess-based `get_status`) |
+
+Security rules for the package:
+- Credential models store **only** `encrypted_payload` — no plaintext `token` or `private_key` fields.
+- SSH private keys are encrypted before storage; the field uses `repr=False`.
+- Real encryption of the payload is deferred to FN-009; the current placeholder is base64-only.