docs: add a Role in the framework section to every module README

Each module README now says where the module sits in the dependency
graph, why it is its own module, and lists use cases for application
developers.

modules/fetchguard/README.md

@@ -12,6 +12,16 @@ Guarded outbound HTTP client and fetcher that blocks private and reserved addres
 
 `fetchguard.Fetch` is a one-shot guarded GET. For calling a service API (any method, JSON or multipart bodies, bearer credentials) build one `fetchguard.Client` per vendor with `fetchguard.NewClient`; it applies the same policy to every request it sends and replaces a plugin's own curl request sender.
 
+## Role in the framework
+
+A small security leaf that depends only on `compass`. `tide` uses it to fetch from the reference backend. It is separate so every outbound call in an application can go through one reviewed, SSRF-safe client.
+
+Use cases:
+
+- Fetch user-supplied URLs (link previews, image imports, webhooks) without reaching internal addresses.
+- Call operator-configured third-party APIs in trusted mode, with timeouts and size limits.
+- Cap response sizes so a hostile endpoint cannot exhaust memory.
+
 ## Features
 
 - HTTPS only in the guarded modes: any other scheme fails with `fetchguard.ReasonScheme`.