docs: bring the live docs back in line with the code

First pass of the documentation audit. Every doc was read against what the code actually
does now; this commit fixes the ones worth keeping and deletes the ones that were only
describing a past.

Corrected:
- CLAUDE.md — said seven WebSocket providers (there are eight, and terminal/vault are byte
  relays now, not translating bridges), listed channels/ as "Telegram / WhatsApp / Discord
  bridges" (they are gone; what remains is how /chat drives an agent turn), missed
  officer-wallet in the PM2 list and notify/ in the layout, and described the per-account
  email SQLite stores without saying they are the sidecar's and that nothing in the platform
  opens them. Further Reading pointed at four files that no longer exist and missed the four
  newest.
- docs/working-on-officer.md — PM2 list was four sidecars short, and it still explained the
  officer-claude rename as news. Replaced with the thing a reader actually needs: which
  process to restart for which change, and why restarting officer no longer costs you a
  terminal or an agent session.
- TODO.md — the "dead username plumbing" item was mostly resolved by deleting the channels,
  and two email items pointed at api/email/email-db.ts, which is sidecar/email/store.ts now.
- AGENTS.md — trailing paragraph listed the design notes being deleted here.
- MUSIC_API.md — playlists were entirely undocumented: seven endpoints the phone app has no
  reference for. Added from the sidecar's own contract.
- docs/jobs-unification.md — phases 1-3 shipped, so it now says so at the top. Phase 4 (push
  notifications) is the only reason the file still exists, and email sync is explicitly no
  longer part of it.

Deleted, all superseded rather than merely old:
- PHONE_APP.md — a February plan for apps that now exist, with their own repo and README.
- MARKETING_WEBSITE.md — a plan for a site this repo does not contain.
- SECURITY_AUDIT.md + SECURITY_FIXES.md — a February audit of a codebase since restructured;
  it still cites queue/handlers, which is now empty.
- docs/DOCKERIZATION_PLAN.md — cites pty-sidecar, whatsapp and projects, all deleted.
- SETUP_GUIDE.md — documents systemd units and setup scripts replaced by PM2 and `bun setup`.
  Not harmless: /etc/systemd/system/officer-pty-sidecar.service is still enabled on this host,
  pointing at a `monorepo/` directory that no longer exists, and has been failing to start
  ever since. That guide is how it got there.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

MUSIC_API.md

@@ -293,6 +293,24 @@ launch to offer "resume".
 
 ---
 
+### Playlists
+
+Server-side playlists, scoped to the calling user. Items are track **keys** — the same
+`<albumRel>/<file>` strings favorites uses — so a playlist survives a reindex as long as the file stays
+put. `404` throughout means "not yours or not there"; the two are deliberately indistinguishable.
+
+| method | path | body | returns |
+|---|---|---|---|
+| `GET` | `/api/music/playlists` | — | `[{ id, name, count, createdAt, updatedAt }]`, most recent first |
+| `POST` | `/api/music/playlists` | `{ name }` | `201` with the row; `409` if the name is taken |
+| `GET` | `/api/music/playlists/:id` | — | `{ id, name, items: [key], … }` |
+| `PATCH` | `/api/music/playlists/:id` | `{ name }` | rename; `409` if taken |
+| `DELETE` | `/api/music/playlists/:id` | — | deletes it, items cascade |
+| `POST` | `/api/music/playlists/:id/items` | `{ keys: [] }` | append → `{ count }` |
+| `PUT` | `/api/music/playlists/:id/items` | `{ keys: [] }` | replace the whole list → `{ count }` |
+
+`PUT` is how you reorder or remove: send the list you want, in order. There is no per-item delete.
+
 ## Notes
 
 - **Covers are server-compressed** (≤600px / q5) — sync them as-is; no client-side resizing needed.