docs: record deferred standalone confirm arm (POST /confirm) in roadmap

[raspbeguy]

Records the design decision from the terraform-provider integration feedback: a standalone HTTP arm endpoint (POST /confirm) is approved in principle but deferred.

Why it matters: the per-write ?confirm shipped in 2.3.0 cannot wrap a whole terraform apply (a DAG apply is N isolated RPCs with no apply-level hook, and each ?confirm mints a separate last-writer-wins window). The Terraform-useful shape is apply-confirm's stage primitive exposed over HTTP.

Locked design constraints captured so the decision is not re-litigated:

• Body names curated resources/scopes, never raw packages; uapi derives the package set and reload-service union from RESOURCE_SOURCES (the same fold /batch does).
• Authz requires uapi:confirm:rw AND :rw on every curated resource backed by the derived package set, not just the resources named: apply-confirm reverts whole uci packages while scopes are per-resource and one package backs many, so package-granularity authz is the only way the deadline auto-revert cannot restore a resource the caller could not write.
• New endpoint, so a 2.4.0 minor, not a 2.3.x patch.
• Merge deferred until apply-confirm is feed-stable and a concrete consumer asks; residual hazards (box-global single-pending lock held for a whole apply; forgotten-ack reverting the whole armed package) want a reference wrapper-with-trap shipped alongside.

Docs-only. No wire surface changes.

🤖 Generated with Claude Code