docs: bring the live docs back in line with the code

First pass of the documentation audit. Every doc was read against what the code actually
does now; this commit fixes the ones worth keeping and deletes the ones that were only
describing a past.

Corrected:
- CLAUDE.md — said seven WebSocket providers (there are eight, and terminal/vault are byte
  relays now, not translating bridges), listed channels/ as "Telegram / WhatsApp / Discord
  bridges" (they are gone; what remains is how /chat drives an agent turn), missed
  officer-wallet in the PM2 list and notify/ in the layout, and described the per-account
  email SQLite stores without saying they are the sidecar's and that nothing in the platform
  opens them. Further Reading pointed at four files that no longer exist and missed the four
  newest.
- docs/working-on-officer.md — PM2 list was four sidecars short, and it still explained the
  officer-claude rename as news. Replaced with the thing a reader actually needs: which
  process to restart for which change, and why restarting officer no longer costs you a
  terminal or an agent session.
- TODO.md — the "dead username plumbing" item was mostly resolved by deleting the channels,
  and two email items pointed at api/email/email-db.ts, which is sidecar/email/store.ts now.
- AGENTS.md — trailing paragraph listed the design notes being deleted here.
- MUSIC_API.md — playlists were entirely undocumented: seven endpoints the phone app has no
  reference for. Added from the sidecar's own contract.
- docs/jobs-unification.md — phases 1-3 shipped, so it now says so at the top. Phase 4 (push
  notifications) is the only reason the file still exists, and email sync is explicitly no
  longer part of it.

Deleted, all superseded rather than merely old:
- PHONE_APP.md — a February plan for apps that now exist, with their own repo and README.
- MARKETING_WEBSITE.md — a plan for a site this repo does not contain.
- SECURITY_AUDIT.md + SECURITY_FIXES.md — a February audit of a codebase since restructured;
  it still cites queue/handlers, which is now empty.
- docs/DOCKERIZATION_PLAN.md — cites pty-sidecar, whatsapp and projects, all deleted.
- SETUP_GUIDE.md — documents systemd units and setup scripts replaced by PM2 and `bun setup`.
  Not harmless: /etc/systemd/system/officer-pty-sidecar.service is still enabled on this host,
  pointing at a `monorepo/` directory that no longer exists, and has been failing to start
  ever since. That guide is how it got there.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

TODO.md

@@ -5,14 +5,11 @@ Deferred work. Context: Officer is collapsing from multi-tenant / open-source-re
 
 ## Single-user cleanup
 
-- [ ] **Remove dead `username` plumbing.** `pi-bridge.spawnPi` no longer uses `username` — it always
-      runs as the service user. But the handlers still compute `toShellUsername(...)` and thread it
-      through `sendAndAwait` → `spawnOptions`, where nothing reads it. `send-claude-code` declares
-      `username` (lines 8, 36) without using it. Typechecks clean today (excess-property checks don't
-      fire on variables), so it silently *looks* load-bearing.
-      Touches: `channels/{whatsapp,telegram,discord}/handler.ts`, `channels/send-and-await.ts`,
-      `channels/send-claude-code.ts`. After this, `toShellUsername` has one caller left
-      (`provision.ts` → `generateClaudeSettings`) and may be inlinable.
+- [ ] **Remove dead `username` plumbing.** Mostly resolved by deleting the chat channels — the
+      handlers and `send-and-await.ts` that threaded `toShellUsername(...)` through to nothing are gone.
+      What remains: `send-claude-code.ts` still declares `username` without using it, and
+      `toShellUsername` has one real caller left (`provision.ts` → `generateClaudeSettings`), so it may
+      be inlinable.
 
 - [x] **Delete or gut `scripts/provision-existing-users.sh`.** Done — deleted the script (it ran
       `sudo useradd …`, the source of the vestigial `andrepadez`/`john-wick`/`fedra`/`miguelbenoliel`
@@ -28,7 +25,7 @@ Deferred work. Context: Officer is collapsing from multi-tenant / open-source-re
 ## Email
 
 - [x] **Gmail-style search operators** (done 2026-07-24, `0e5b91e`). `parseEmailQuery` +
-      `searchEmails` in `api/email/email-db.ts` parse: `from:`/`to:`/`subject:`/`body:` → FTS5 column
+      `searchEmails` in `sidecar/email/store.ts` parse: `from:`/`to:`/`subject:`/`body:` → FTS5 column
       filters; `has:attachment`, `is:unread`/`is:read`, `label:X`, `before:`/`after:YYYY-MM-DD` → SQL
       `WHERE` on `emails`; quoted values → exact phrases; free text → prefix-AND full-text; unknown
       `op:val` falls back to free text. Structured-filters-only queries skip the FTS join. Validated
@@ -45,7 +42,7 @@ Deferred work. Context: Officer is collapsing from multi-tenant / open-source-re
 
 - [x] **Conversation threading** (done 2026-07-24, `ee11c94`). `thread_id` column on `emails`:
       header-based for new mail (`id` = `sha1(Message-Id)`, so `References[0]` hashes to the root's
-      id — `computeThreadId` in `email-db.ts`), subject+counterpart backfill for already-synced mail.
+      id — `computeThreadId` in `sidecar/email/store.ts`), subject+counterpart backfill for already-synced mail.
       `/messages` collapses to one row per thread (window fn) with count/unread; `/thread/:id` +
       `/thread/:id/read`; reader renders a collapsible stack. Verified on synthetic + 18k real DB.
   - [ ] **Upgrade old mail to exact threading.** One-time full re-fetch to capture `References` for