ADR-0002: owner defaults live in the DB row; .env keeps deployment config and secrets

Records the config boundary the #127 owner-default columns establish:
.env = boot-time deployment config + secrets (never DB), user_ai_prefs
single row = per-request owner defaults (hot-tunable, no secrets),
resolution request param -> owner default -> hard default, and the
safe-by-default privacy posture for default_backend. Adds the
Configuration glossary section to CONTEXT.md (owner default,
deployment config, hard default).

CONTEXT.md

@@ -62,3 +62,25 @@ Insights and pre-computed artifacts grouped by calendar day (daily message summa
 reel pre-generation). Because it is keyed on the day, re-dating a photo across a day
 boundary invalidates the derived data for that day, which regenerates on its normal schedule.
 _Avoid_: cache, nightly output
+
+### Configuration
+
+**Owner default**:
+A per-request default the owner sets for the whole deployment — the model, backend,
+persona, reel span, or segment cap a client gets when it omits the field. Stored in the
+single `user_ai_prefs` row, hot-tunable without a redeploy, and global: every client that
+omits the field gets it, on every device. Never holds secrets.
+_Avoid_: user prefs, user settings, preferences (ambiguous with device-local client state)
+
+**Deployment config**:
+Values the server needs before it can start serving — bind address, database path, media
+roots, the URLs used to build clients — plus every secret. Lives in `.env` only; changing
+it is a redeploy, by design.
+_Avoid_: environment config, system config
+
+**Hard default**:
+The env/code fallback a request lands on when neither an explicit param nor a stored
+owner default supplies the field (e.g. backend `local`, persona `default`, reel span
+day). It is the floor under the owner-default layer: env changes keep working whenever a
+default column is NULL.
+_Avoid_: fallback value, env default