优化结构

internal/server/README.md

@@ -8,5 +8,10 @@ grouped by role:
 - `router/`: resource route registration and the system route registrar
 - `httpx/`: system adapter for shared response and cookie helpers
 
+Cross-cutting route policy lives in `internal/routecatalog`: public/private
+Swagger security, operation-audit flags, sensitive request-body handling and
+API group/description metadata must be declared there. Router contract tests
+keep the catalog aligned with the Gin registrations.
+
 Keep new files in the matching role directory instead of adding transport files
 to the root package.