docs: bring the live docs back in line with the code

First pass of the documentation audit. Every doc was read against what the code actually
does now; this commit fixes the ones worth keeping and deletes the ones that were only
describing a past.

Corrected:
- CLAUDE.md — said seven WebSocket providers (there are eight, and terminal/vault are byte
  relays now, not translating bridges), listed channels/ as "Telegram / WhatsApp / Discord
  bridges" (they are gone; what remains is how /chat drives an agent turn), missed
  officer-wallet in the PM2 list and notify/ in the layout, and described the per-account
  email SQLite stores without saying they are the sidecar's and that nothing in the platform
  opens them. Further Reading pointed at four files that no longer exist and missed the four
  newest.
- docs/working-on-officer.md — PM2 list was four sidecars short, and it still explained the
  officer-claude rename as news. Replaced with the thing a reader actually needs: which
  process to restart for which change, and why restarting officer no longer costs you a
  terminal or an agent session.
- TODO.md — the "dead username plumbing" item was mostly resolved by deleting the channels,
  and two email items pointed at api/email/email-db.ts, which is sidecar/email/store.ts now.
- AGENTS.md — trailing paragraph listed the design notes being deleted here.
- MUSIC_API.md — playlists were entirely undocumented: seven endpoints the phone app has no
  reference for. Added from the sidecar's own contract.
- docs/jobs-unification.md — phases 1-3 shipped, so it now says so at the top. Phase 4 (push
  notifications) is the only reason the file still exists, and email sync is explicitly no
  longer part of it.

Deleted, all superseded rather than merely old:
- PHONE_APP.md — a February plan for apps that now exist, with their own repo and README.
- MARKETING_WEBSITE.md — a plan for a site this repo does not contain.
- SECURITY_AUDIT.md + SECURITY_FIXES.md — a February audit of a codebase since restructured;
  it still cites queue/handlers, which is now empty.
- docs/DOCKERIZATION_PLAN.md — cites pty-sidecar, whatsapp and projects, all deleted.
- SETUP_GUIDE.md — documents systemd units and setup scripts replaced by PM2 and `bun setup`.
  Not harmless: /etc/systemd/system/officer-pty-sidecar.service is still enabled on this host,
  pointing at a `monorepo/` directory that no longer exists, and has been failing to start
  ever since. That guide is how it got there.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -3,7 +3,7 @@
 ## Project Overview
 
 Officer is a self-hosted personal platform for one person: the server owner. It bundles an AI agent,
-a terminal, a file browser, a code editor, email, chat channels, a remote desktop and customisable
+a terminal, a file browser, a code editor, email, a bitcoin wallet, a remote desktop and customisable
 dashboards behind a single web app.
 
 **Single-user is a hard invariant, not a stage.** There is exactly one account, created once by
@@ -17,15 +17,16 @@ One Bun process (`src/server.tsx`) serves everything:
 
 - the React SPA, via Bun's HTML import of `src/apps/officer-web/index.html` (HMR in dev)
 - the REST API, a Hono app mounted at `/api` (`src/servers/hono.ts`)
-- seven WebSocket providers — terminal, chat, task-runner, pipeline, cliamp, cliamp-audio,
-  desktop — plus the vault notifications hub and a sidecar registration socket
+- eight WebSocket providers — terminal, chat, task-runner, pipeline, cliamp, cliamp-audio, desktop,
+  vault — plus a sidecar registration socket. `terminal` is a byte relay onto the pty sidecar's own
+  listener, not a translating bridge; `vault` is the same shape onto Vaultwarden's notifications hub.
 - a browser relay on its own port (`BROWSER_RELAY_PORT`, default 18792)
 
 Long-running and privileged work lives in **sidecars**: separate processes that dial back in over
 `/api/sidecar/register` and are tracked in `src/servers/sidecar-registry.ts`. PM2 runs them
 (`ecosystem.config.cjs`): `officer` (the server), `officer-anthropic-proxy`, `officer-agent`,
 `officer-opencode`, `officer-email`, `officer-pty`, `officer-vnc`, `officer-music`, `officer-vault`,
-`officer-slskd`, `officer-headscale`, `officer-transmission`, `officer-invoiceshelf`.
+`officer-slskd`, `officer-headscale`, `officer-transmission`, `officer-invoiceshelf`, `officer-wallet`.
 
 **`officer-anthropic-proxy` and `officer-agent` are not the same thing.** The proxy holds the Anthropic
 credential and forwards API traffic; the agent is the process that spawns `claude`. They were one entry
@@ -48,7 +49,8 @@ src/
 │   ├── hono.ts             # router composition; everything under /api
 │   ├── _middlewares/       # auth, body parsing, origin validation, rate limiting
 │   ├── api/<feature>/      # one folder per feature, each exporting a router
-│   ├── channels/           # Telegram / WhatsApp / Discord bridges
+│   ├── channels/           # send-claude-code / send-opencode — how /chat drives an agent turn
+│   ├── notify/             # outbound notifications (Discord webhook, env-configured)
 │   ├── queue/              # background job engine
 │   └── sidecar/            # sidecar implementations + the wire protocol
 ├── databases/officer_db/   # the only database (Postgres + Drizzle)
@@ -83,8 +85,9 @@ email accounts, queue and pipeline jobs. Schema in `src/schema/`, hand-written q
 
 **The filesystem** holds everything the agent authors. `OFFICER_ITEMS_DIR` contains one directory
 per item under `skills/`, `tools/`, `tasks/`, `processes/`, `extensions/` — no database rows, no
-scope tiers. `DATA_PATH/<email>/` holds the managed home, attachments and per-account email SQLite
-stores. Path helpers live in `src/servers/data-path.ts`; note `getHomeDir` (the managed home under
+scope tiers. `DATA_PATH/<email>/` holds the managed home, attachments and the per-account email SQLite
+stores — those are the **email sidecar's**, and nothing in the platform opens them. Path helpers live in
+`src/servers/data-path.ts`; note `getHomeDir` (the managed home under
 `DATA_PATH`) versus `getOwnerHomeDir` (the owner's real login home when `HOME_DIR` is set, which is
 where terminals, chats and task runs actually execute).
 
@@ -245,12 +248,15 @@ link-focusable). Half the app still does this; none of the new code should.
 
 ## Further Reading
 
-- `CONVENTIONS.md` — component organisation, state management, React patterns, with rationale
 - `docs/navigation-audit.md` — **authoritative** on routing/navigation: the opaque-click anti-pattern,
   a severity-ranked findings table, the channel-selection map and the four-phase plan
+- `docs/sidecar-topology.md` — where the sidecar architecture is going, and what was considered and dropped
+- `docs/working-on-officer.md` — how to run, restart and check your work on this machine
+- `docs/wallet-key-custody.md` — what the platform can and cannot see of the wallet
 - `TODO.md` — current direction and deferred work; **takes precedence over this file where they disagree**
 - `src/apps/CLAUDE.md` — shared frontend patterns
 - `src/databases/CLAUDE.md` — database patterns
+- `CONVENTIONS.md` — component organisation, state management and React patterns, with rationale;
+  `src/workspaces/officerdev/APP_CONVENTIONS.md` and `HOOK_CONVENTIONS.md` for panel apps and hooks
 
-The other markdown files in the repo root (`OFFICERDEV_*.md`, `MARKETING_WEBSITE.md`, `PHONE_APP.md`,
-`SECURITY_AUDIT.md`, `SETUP_*.md`, …) are older design notes. Treat the code as the source of truth.
+Treat the code as the source of truth where anything here disagrees with it.