Architecture doc describing credentials

.cspellignore

@@ -1175,6 +1175,7 @@ testrp
 testsyncresources
 tf
 tfexec
+tfvars
 tgz
 th
 throughs

docs/architecture/README.md

@@ -26,6 +26,8 @@ change-safety guidance.
   backend services.
 - [state-persistence.md](state-persistence.md) explains the shared database,
   secret, and queue abstractions used by the control-plane services.
+- [credentials.md](credentials.md) explains how cloud credentials are stored
+  and used for deployments, and how clients authenticate to a Radius install.
 - [application-graph.md](application-graph.md) explains how the application
   graph is computed from stored resources and displayed via the CLI.
 
@@ -41,12 +43,13 @@ If you are new to the codebase, read these in order:
 6. [controller.md](controller.md)
 7. [rad-cli.md](rad-cli.md)
 8. [state-persistence.md](state-persistence.md)
-9. [application-graph.md](application-graph.md)
+9. [credentials.md](credentials.md)
+10. [application-graph.md](application-graph.md)
 
 ## Related Material
 
 - UCP-specific background and older walkthroughs live in [../ucp](../ucp).
 - contributor-oriented operational setup lives in
   [../contributing](../contributing).
 - larger design proposals and historical decisions live in the external
-  `radius-project/design-notes` repository.
+  `radius-project/design-notes` repository.