docs: add 2-tier hybrid architecture guide, changelog, and guard upstream-only workflows

[JOY (JOY)]

Summary

• Add 2-Tier Hybrid Architecture specification to docs/Architecture.md.
• Add platform CHANGELOG.md documenting v2.0.0 Crove Cal release.
• Guard upstream-only workflows (cleanup-report.yml, cleanup.yml, draft-release.yml, i18n.yml, post-release.yml,
  elease-docker.yaml) with if: github.repository == 'calcom/cal.diy' to eliminate failed CI notifications on fork repo.

Test plan

• Verified workflow syntax and docs.

---

Note

Low Risk
Changes are documentation plus workflow if guards; no application runtime or auth logic is modified in this diff.

Overview
Adds Crove Cal v2.0.0 documentation: a new CHANGELOG.md release notes entry and docs/Architecture.md describing the 2-tier hybrid model (DOS ID / webhook org sync + MCP agent actions), OIDC integration, and branding/fork maintenance practices.

CI fork safety: upstream-only GitHub Actions jobs now skip unless github.repository == 'calcom/cal.diy' in cleanup-report, cleanup, draft-release, post-release, and release-docker (prepare job). The i18n workflow combines that check with the existing Lingo API key guard so automation does not run (or fail) on fork repos.

^{Reviewed by Cursor Bugbot for commit 1b41043. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_c60f0c90-651f-4e64-95bf-16329ff0f3c7)

[github-actions]

Welcome to Cal.diy, JOY (@JOY)! Thanks for opening this pull request.

A few things to keep in mind:

• This is Cal.diy, not Cal.com. Cal.diy is a community-driven, fully open-source fork of Cal.com licensed under MIT. Your changes here will be part of Cal.diy — they will not be deployed to the Cal.com production app.
• Please review our Contributing Guidelines if you haven't already.
• Make sure your PR title follows the Conventional Commits format.

A maintainer will review your PR soon. Thanks for contributing!

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: eb4e45ee-740a-4d23-86a5-13e72d72e2cd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request introduces a comprehensive architecture guide (docs/Architecture.md) and a corresponding changelog (CHANGELOG.md) detailing the adoption of a 2-tier hybrid architecture, centralized OIDC authentication via DOS ID, and automated branding pipelines. Feedback on the documentation highlights discrepancies between the documented webhook events and their actual implementation, specifically pointing out missing and unimplemented events.

[gemini-code-assist]

There are a few discrepancies between this documentation and the actual webhook implementation in apps/web/app/api/webhooks/dos-org-sync/route.ts:

1. Missing Events: The events organization.member.added and organization.member.removed (using dot notation) are supported in the webhook handler but are not documented here.
2. Unimplemented Event: The user.updated event is listed here, but it is currently not handled in the webhook's switch statement (it falls through to the default case and is ignored).

Let's update the documentation to accurately reflect the implemented events.

Suggested change

	4. **Đồng bộ Thời gian thực qua Webhook (Event-Driven Webhook Sync)**:
	- Endpoint: `/api/webhooks/dos-org-sync` tiếp nhận các sự kiện được ký HMAC-SHA256:
	- `organization.created` / `org.created`
	- `organization.updated` / `org.updated`
	- `organization.deleted` / `org.deleted`
	- `organization.member_added` / `org.member_added`
	- `organization.member_removed` / `org.member_removed`
	- `user.updated`
	4. **Đồng bộ Thời gian thực qua Webhook (Event-Driven Webhook Sync)**:
	- Endpoint: `/api/webhooks/dos-org-sync` tiếp nhận các sự kiện được ký HMAC-SHA256:
	- `organization.created` / `org.created`
	- `organization.updated` / `org.updated`
	- `organization.deleted` / `org.deleted`
	- `organization.member_added` / `organization.member.added` / `org.member_added`
	- `organization.member_removed` / `organization.member.removed` / `org.member_removed`