docs: bring the live docs back in line with the code

First pass of the documentation audit. Every doc was read against what the code actually
does now; this commit fixes the ones worth keeping and deletes the ones that were only
describing a past.

Corrected:
- CLAUDE.md — said seven WebSocket providers (there are eight, and terminal/vault are byte
  relays now, not translating bridges), listed channels/ as "Telegram / WhatsApp / Discord
  bridges" (they are gone; what remains is how /chat drives an agent turn), missed
  officer-wallet in the PM2 list and notify/ in the layout, and described the per-account
  email SQLite stores without saying they are the sidecar's and that nothing in the platform
  opens them. Further Reading pointed at four files that no longer exist and missed the four
  newest.
- docs/working-on-officer.md — PM2 list was four sidecars short, and it still explained the
  officer-claude rename as news. Replaced with the thing a reader actually needs: which
  process to restart for which change, and why restarting officer no longer costs you a
  terminal or an agent session.
- TODO.md — the "dead username plumbing" item was mostly resolved by deleting the channels,
  and two email items pointed at api/email/email-db.ts, which is sidecar/email/store.ts now.
- AGENTS.md — trailing paragraph listed the design notes being deleted here.
- MUSIC_API.md — playlists were entirely undocumented: seven endpoints the phone app has no
  reference for. Added from the sidecar's own contract.
- docs/jobs-unification.md — phases 1-3 shipped, so it now says so at the top. Phase 4 (push
  notifications) is the only reason the file still exists, and email sync is explicitly no
  longer part of it.

Deleted, all superseded rather than merely old:
- PHONE_APP.md — a February plan for apps that now exist, with their own repo and README.
- MARKETING_WEBSITE.md — a plan for a site this repo does not contain.
- SECURITY_AUDIT.md + SECURITY_FIXES.md — a February audit of a codebase since restructured;
  it still cites queue/handlers, which is now empty.
- docs/DOCKERIZATION_PLAN.md — cites pty-sidecar, whatsapp and projects, all deleted.
- SETUP_GUIDE.md — documents systemd units and setup scripts replaced by PM2 and `bun setup`.
  Not harmless: /etc/systemd/system/officer-pty-sidecar.service is still enabled on this host,
  pointing at a `monorepo/` directory that no longer exists, and has been failing to start
  ever since. That guide is how it got there.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/working-on-officer.md

@@ -14,7 +14,7 @@ officer/
 ```
 
 Officer is a self-hosted personal platform: an AI agent, a terminal, a file browser, a code editor,
-email, chat channels, a remote desktop and dashboards, behind one web app. **It serves exactly one
+email, a bitcoin wallet, a remote desktop and dashboards, behind one web app. **It serves exactly one
 person — the owner of this server.** There is no tenancy, no roles, no other users. If a question
 turns on "which user", the answer is the owner.
 
@@ -59,11 +59,16 @@ Commit messages: simple lowercase, no prefixes, explaining *why*.
 
 The server runs under pm2 as `officer`, plus sidecars (`officer-anthropic-proxy`, `officer-agent`,
 `officer-opencode`, `officer-email`, `officer-pty`, `officer-vnc`, `officer-music`, `officer-vault`,
-`officer-slskd`). `pm2 list` shows them; `pm2 logs officer` follows.
+`officer-slskd`, `officer-headscale`, `officer-transmission`, `officer-invoiceshelf`, `officer-wallet`).
+`pm2 list` shows them; `pm2 logs officer` follows.
 
 Two of those names are worth knowing apart: **`officer-anthropic-proxy` holds the Anthropic credential
-and proxies API traffic; `officer-agent` is the process that actually runs `claude`.** They used to be
-one confusingly-named entry (`officer-claude`) that was only the proxy.
+and proxies API traffic; `officer-agent` is the process that actually runs `claude`.**
+
+**Which process to restart.** A change under `src/servers/sidecar/<name>/` needs that sidecar restarted;
+a change anywhere else needs `officer`. Both, if you changed the wire between them. Restarting `officer`
+no longer costs you a running agent session or a terminal — every sidecar is a PM2 peer, and the terminal
+and email sidecars serve their own listeners, so `officer` is not in their data path at all.
 
 **Don't restart the owner's server to test.** Boot your own on a spare port instead — the running
 instance holds `PORT` from `.env` (9010):