docs: update README with domain module architecture and encrypted fragment details

Co-Authored-By: Warp <agent@warp.dev>

README.md

@@ -123,17 +123,20 @@ The `backend/` directory contains a .NET 10 implementation that provides the sam
 
 ```
 Entry (thin command dispatcher)
-  ├── IFragmentService → FragmentService → IFragmentRepository
-  ├── IEntryFileService → EntryFileService → IEntryFileRepository
-  ├── IEntrySearchService → EntrySearchService
-  ├── IVaultStorageService → VaultStorageService → IVaultCryptoService
-  ├── IJournalDatabaseService → JournalDatabaseService (SQLCipher)
-  ├── IAiService → PythonSidecarAiService | DisabledAiService
-  ├── ISpeechBridgeService → PythonSidecarSpeechService | DisabledSpeechBridgeService
-  ├── CommandLogger
-  └── IJournalConfigService → JournalConfigService
+  ├── Fragments/    IFragmentService → FragmentService → IFragmentRepository (SQLCipher)
+  ├── Entries/      IEntryFileService, IEntrySearchService, JournalParser, HtmlSanitizer
+  ├── Vault/        IVaultStorageService → VaultStorageService → IVaultCryptoService
+  ├── Database/     IJournalDatabaseService (SQLCipher schema/key derivation)
+  │                 IDatabaseSessionService (encrypted connection lifecycle after auth)
+  ├── Ai/           IAiService → PythonSidecarAiService | DisabledAiService
+  ├── Speech/       ISpeechBridgeService → PythonSidecarSpeechService | DisabledSpeechBridgeService
+  ├── Sidecar/      PythonSidecarClient (shared Python process I/O), SidecarCli
+  ├── Logging/      CommandLogger, LogRedactor
+  └── Config/       IJournalConfigService → JournalConfigService
 ```
 
+Services are organized under `Journal.Core/Services/` in domain-specific subdirectories, each with its own namespace (e.g. `Journal.Core.Services.Ai`).
+
 ### Build & Run
 
 ```bash
@@ -179,6 +182,8 @@ dotnet run --project Journal.SmokeTests
 
 - Vault: AES-256-GCM with PBKDF2-HMAC-SHA256 key derivation (600k iterations)
 - Database: SQLCipher with PBKDF2-derived key
+- Standalone fragments are stored in the encrypted SQLCipher database (requires auth via `vault.load_all` or `db.hydrate_workspace`)
+- `DatabaseSessionService` holds the encryption password in memory after first authentication
 - Wire format matches the Python implementation for cross-language parity
 
 ## Notes