docs: apply prettier formatting

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: aspiers

docs/architecture.md

@@ -80,7 +80,6 @@ endpoint to issue an AT Protocol authorization code. For new users, a handle-pic
   `pds.example`). A single-domain design — one origin, routing the auth paths
   by path prefix the way [pds-gatekeeper](https://tangled.org/baileytownsend.dev/pds-gatekeeper)
   does — was **considered and rejected**. The reasons:
-
   - **Mechanism (how the takeover happens)**: PDS Core overrides the
     Authorization Server metadata so `authorization_endpoint` points at the
     Auth Service. OAuth clients redirect the browser straight there, so the
@@ -117,7 +116,6 @@ endpoint to issue an AT Protocol authorization code. For new users, a handle-pic
 
   **On re-examination, none of the three benefits is a non-negotiable, and all
   the costs are artifacts of being cross-origin-but-same-site:**
-
   - _Cookie isolation_ is already done by explicit cookie **naming**
     (`epds_csrf`, `magic_account_session`, the `DEVICE_COOKIE_NAMES` set), not
     by origin — so it survives a collapse to one origin, optionally hardened
@@ -139,7 +137,6 @@ endpoint to issue an AT Protocol authorization code. For new users, a handle-pic
 
   Beyond dissolving those costs, collapsing to one origin has **positive**
   benefits the split forecloses:
-
   - **Fewer privileged cross-service endpoints.** The split forces the two
     services to talk over authenticated HTTP: the HMAC-signed
     `/oauth/epds-callback` and the `/_internal/*` / `/_magic/*` lookup

docs/design/single-domain-migration.md

@@ -13,15 +13,15 @@ that case is accepted and focuses on _how_.
 
 ## Summary of the change
 
-| Concern | Today (two origins) | After (one origin) |
-| --- | --- | --- |
-| Auth UI location | `https://auth.pds.example/oauth/authorize`, `/auth/*`, `/account/*` | `https://pds.example/auth/*` (path-prefixed) |
-| `authorization_endpoint` (AS metadata) | `https://auth.<host>/oauth/authorize` | `https://<host>/auth/oauth/authorize` |
-| `sec-fetch-site` on `/oauth/authorize` | `same-site`, rewritten to `same-origin` (item 5) | naturally `same-origin` — rewrite **deleted** |
-| Device-session cookies | `Domain=<parent>` so sibling subdomain can read them (items 14–15) | host-only on the single origin — **plumbing deleted** |
-| Auth session cookie | `magic_account_session` / better-auth `session` on `auth.<host>` | same names, path-scoped `/auth` on `<host>` |
-| CSP | per-route in each service (unchanged approach) | per-route, unchanged |
-| Deploy units | two services | still two processes, one origin (Caddy path-routes) — or merged later |
+| Concern                                | Today (two origins)                                                 | After (one origin)                                                    |
+| -------------------------------------- | ------------------------------------------------------------------- | --------------------------------------------------------------------- |
+| Auth UI location                       | `https://auth.pds.example/oauth/authorize`, `/auth/*`, `/account/*` | `https://pds.example/auth/*` (path-prefixed)                          |
+| `authorization_endpoint` (AS metadata) | `https://auth.<host>/oauth/authorize`                               | `https://<host>/auth/oauth/authorize`                                 |
+| `sec-fetch-site` on `/oauth/authorize` | `same-site`, rewritten to `same-origin` (item 5)                    | naturally `same-origin` — rewrite **deleted**                         |
+| Device-session cookies                 | `Domain=<parent>` so sibling subdomain can read them (items 14–15)  | host-only on the single origin — **plumbing deleted**                 |
+| Auth session cookie                    | `magic_account_session` / better-auth `session` on `auth.<host>`    | same names, path-scoped `/auth` on `<host>`                           |
+| CSP                                    | per-route in each service (unchanged approach)                      | per-route, unchanged                                                  |
+| Deploy units                           | two services                                                        | still two processes, one origin (Caddy path-routes) — or merged later |
 
 The routing model is exactly pds-gatekeeper's: **Caddy routes by path**, sending
 `/auth/*` (and the auth-owned `/oauth/authorize`, `/account/*`) to the