Update architecture and infrastructure docs

docs/architecture.md

@@ -149,7 +149,7 @@ Last.fm schemas (separate, not Ecto-persisted to main DB):
 | `Discogs` / `Discogs.API` | discogs.com | Artist profiles, images |
 | `Wikipedia` / `Wikipedia.API` | wikipedia.org | Artist biographies |
 | `BraveSearch` / `BraveSearch.API` | search.brave.com | Cover art and artist image search |
-| `OpenAI` / `OpenAI.API` | api.openai.com | Text embeddings for similarity, streaming chat via Responses API (gpt-4.1 + web search) |
+| `OpenAI` / `OpenAI.API` | api.openai.com | Text embeddings for similarity, streaming chat via Responses API (gpt-4.1 + web search), rate-limited |
 | `MusicLibrary.Mailer` | Mailgun (via Swoosh) | Transactional email delivery (error notifications, daily digest) |
 
 Each has a `Config` module reading from application env. In tests, all HTTP calls are
@@ -278,7 +278,7 @@ All authenticated routes live inside a single `live_session` with three `on_moun
 | `Notes` | CollectionLive.Show, WishlistLive.Show, ArtistLive.Show | Markdown note rendering and editing |
 | `AddRecord` | CollectionLive.Index, WishlistLive.Index | MusicBrainz import interface |
 | `BarcodeScanner` | CollectionLive.Index | Barcode scanning UI (uses barcode-detector JS) |
-| `Release` | CollectionLive.Show, ScrobbleLive.Show | MusicBrainz release display with scrobble |
+| `Release` | CollectionLive.Show, ScrobbleLive.Show | MusicBrainz release display with scrobble (form-based with auto-recovery) |
 
 ### Shared Component Modules (lib/music_library_web/components/)
 

docs/production-infrastructure.md

@@ -64,7 +64,7 @@ SQLite extensions loaded at runtime: `unicode`, `vec0` (vector search).
 ### Litestream (continuous)
 
 Configured inline in `compose.yaml`. Runs as a separate Docker Compose service
-(`litestream/litestream`) sharing the database volume.
+(`litestream/litestream:0.5.11-scratch`) sharing the database volume.
 
 | Setting | Value |
 |---------|-------|
@@ -108,6 +108,17 @@ Push to main (or PR / manual dispatch)
 A manual verification workflow (`.github/workflows/verify.yml`) can be triggered via
 `workflow_dispatch` to re-run production checks without deploying.
 
+### Dependency management (Dependabot)
+
+Automated dependency updates via GitHub Dependabot (`.github/dependabot.yml`):
+
+- **Docker**: daily checks for base image updates
+- **Elixir (mix)**: daily checks, max 10 open PRs
+- **NPM**: daily checks, max 10 open PRs, ignores path-based local deps
+- **GitHub Actions**: daily checks for action version updates
+
+Fluxon (private dependency) is configured with a dedicated registry entry.
+
 ### Post-deploy verification
 
 `test/prod.hurl` checks:
@@ -238,7 +249,7 @@ All HTTP clients use `Req` with per-API rate limiting (`Req.RateLimiter`, ETS-ba
 | Discogs | 2000 ms cooldown | Artist profiles, images |
 | Wikipedia | 1000 ms cooldown | Artist biographies |
 | Brave Search | 1000 ms cooldown | Cover art, artist image search |
-| OpenAI | — | Text embeddings (similarity), streaming chat |
+| OpenAI | 250 ms cooldown | Text embeddings (similarity), streaming chat |
 
 ---