docs: HQ dispute lock and purge contract

CLAUDE.md

@@ -999,6 +999,15 @@ plane, each of which this codebase enforces:
 - **`FREE_INSTANCE_REAP_AFTER` must match admin's value.** Admin names the date
   in its warning emails; this side performs the delete, because it is the only
   service that knows which collections carry `instance_id`.
+- **Disputes lock and purge instances.** HQ writes `instances.locked_at` when
+  an account is disputed and `instances.purge_after` only once the dispute
+  fails. `services.InstanceLocked` (60s cache) refuses sessions, API tokens
+  and agents on a locked instance, and `GetInstanceBySlug` hides it from the
+  host resolver. The check in `auth.Middleware` is explicit because the host
+  guard only runs when a host resolves. `ReapTerminatedInstances` purges once
+  both fields are present and `purge_after` has passed, independent of
+  `FREE_INSTANCE_REAP_AFTER`, and `ReapFreeInstances` skips locked instances
+  so a restore finds them intact.
 
 ## MongoDB Collections