docs(d25): module order, username login, nginx XFF, hardcoded-DB caveat

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/06-DECISIONS.md

@@ -446,3 +446,19 @@ polish on top of the existing `<900px` drawer + scrolling tables: safe-area inse
 (`viewport-fit=cover`), 16px inputs (kills iOS focus-zoom), 40px tap targets, bottom-sheet
 dialogs. Also hardened the deploy: `nginx` now sends `X-Forwarded-For $remote_addr` (replace,
 not append) so the D24 per-IP rate limiters can't be bypassed by a spoofed header.
+
+## D25 addenda (2026-07-18)
+- **Module display order**: `module.sort_order` (both engines) — the app lists modules
+  SMS > RTGS > WhatsApp > MobileApp > RecoverX > CloudBackup > ATM > AMC; owner-editable
+  config (default 100 trails). Set on the live data.
+- **Login by username**: `staff_user.username` (unique, both engines) is the login
+  identifier; `email` is demoted to a plain contact field on the user (kept required at the
+  DB for now — making it optional is a later table rebuild). Existing accounts backfill
+  username=email so logins are unbroken; `login()` matches username OR email. Employees can
+  be created with an explicit username.
+- **Nginx XFF** hardened to `$remote_addr` (replace) so the D24 per-IP limiters can't be
+  spoofed. **Note (open, user's deliberate edit):** `server.ts` carries a placeholder
+  `HARDCODED_DATABASE_URL` gated to production — must NOT be filled with the real password
+  in source (it would push to Gitea); use a Docker secret / gitignored file instead.
+- In progress: brighter document type/status colours + sectioned Client-360 details +
+  Employees username field (frontend).