fix(HEL-494): enforce datahub as sole website market boundary

Co-authored-by: multica-agent <github@multica.ai>

ARCHITECTURE.md

@@ -38,10 +38,15 @@ background scheduler
   fields, and feature-specific exceptions belong to `backend/features/<feature>/routes.py`.
 - `backend/features/<feature>/` owns the mechanically moved service, repository, HTTP, agent,
   or deterministic calculation code for that product area.
-- `backend/data/` owns provider construction, source policy, provenance, units, freshness,
-  coverage, display-versus-calculation eligibility, and shared numeric normalization policies.
+- `backend/data/` owns the website-side DataHub client, stable dataset contracts, provenance,
+  units, freshness, coverage, display-versus-calculation eligibility, and shared numeric
+  normalization policies. The website process does not construct or configure external market
+  providers; provider credentials, source selection, retries, fallbacks, caching, and backfill
+  belong exclusively to the `xiaobai-datahub` service.
 - `backend/data/providers/tushare_client.py` is the stable public `TushareClient` facade and
-  owns only its dataclass fields and shared cache state. Tushare HTTP transport belongs to
+  is retained as the dataset-contract compatibility surface and isolated test facade. Production
+  website services never instantiate it directly: its query methods are served by the DataHub
+  proxy. Its split modules document the stable contract: Tushare HTTP transport belongs to
   `tushare_transport.py`; market overview and realtime breadth belong to
   `tushare_dashboard.py`; indices belong to `tushare_indices.py`; Shenwan membership and
   industry snapshots belong to `tushare_industries.py`; generic sector snapshots belong to