docs: Add ADR-011 for hybrid OAuth + AppAPI deployment architecture
The note is not visible to the blocked user.