Add deployment guidelines, assets/attachments spec, and humans-and-permissions plan

Document local-trusted vs cloud-hosted deployment scenarios in
PRODUCT.md. Spec out assets and issue_attachments tables with storage
provider abstraction and attachment API endpoints. Draft comprehensive
plan for human users, memberships, invites, permissions, and
agent-to-human task delegation across both deployment modes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

doc/PRODUCT.md

@@ -9,6 +9,7 @@ Paperclip is the control plane for autonomous AI companies. One instance of Pape
 ### Company
 
 A company has:
+
 - A **goal** — the reason it exists ("Create the #1 AI note-taking app that does $1M MRR within 3 months")
 - **Employees** — every employee is an AI agent
 - **Org structure** — who reports to whom
@@ -20,6 +21,7 @@ A company has:
 Every employee is an agent. When you create a company, you start by defining the CEO, then build out from there.
 
 Each employee has:
+
 - **Adapter type + config** — how this agent runs and what defines its identity/behavior. This is adapter-specific (e.g., an OpenClaw agent might use SOUL.md and HEARTBEAT.md files; a Claude Code agent might use CLAUDE.md; a bare script might use CLI args). Paperclip doesn't prescribe the format — the adapter does.
 - **Role & reporting** — their title, who they report to, who reports to them
 - **Capabilities description** — a short paragraph on what this agent does and when they're relevant (helps other agents discover who can help with what)
@@ -80,6 +82,13 @@ More detailed task structure TBD.
 6. Set budgets, define initial strategic tasks
 7. Hit go — agents start their heartbeats and the company runs
 
+## Guidelines
+
+There are two deployment scenarios that need to be maintained:
+
+- a single user, local trusted deployment - this should be easy to install with a single `npx paperclip run` command and the environment is trusted and self-contained on a local machine (e.g. local files, agents, embedded db, easy to use)
+- multi-user cloud deployment - allows for a hosted deploy (remote deployment, user logins, hosted db, scalable)
+
 ## Further Detail
 
 See [SPEC.md](./SPEC.md) for the full technical specification and [TASKS.md](./TASKS.md) for the task management data model.