release(v4.0.0): Shade GA — V3.x consolidation + audit prep

V3.1 → V3.12 consolidated and tagged for the first GA release. Wire
format unchanged from 0.4.x — 4.0 peers interoperate with 0.4.x peers
byte-for-byte. The version bump is semantic: audit-cycle complete,
opt-in surface fully exposed, threat model refreshed for every new
surface.

Highlights:
- All 24 @shade/* packages bumped to 4.0.0 in lockstep.
- CHANGELOG 4.0.0 section is the canonical manifest of what landed.
- THREAT-MODEL extended (§10 fingerprint gates, §11 WebRTC P2P, §12
  Web-Worker boundary) + residual-risks table refreshed.
- OpenAPI now covers all 27 routes: prekey, transfer, KT, inbox,
  bridge, observer, /metrics, /healthz, /ready.
- MIGRATION 0.3.x → 4.0 documented + smoke-tested against
  shade migrate-storage on a real SQLite DB.
- docs/audit/REVIEW-BUNDLE.md + SCOPE.md ready for external reviewer.
- scripts/soak.ts harness for the GA-stable 2-week soak window.
- All V*.md plans archived under docs/archive/ with Status: Done.
- Voice/Video carved out into V5.0; 4.0 audit focuses on the frozen
  non-realtime stack.

Tests: TS 1000/1000 + Kotlin 11/11 cross-platform vectors green.
Docker: gt.zyon.no/stian/shade-prekey:4.0.0 builds and reports
  version 4.0.0 on /health.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/cross-vectors.yml

@@ -0,0 +1,90 @@
+name: Cross-platform vectors
+
+# V3.5 §CI parity gate. Both runners load test-vectors/*.json and verify their
+# native implementation produces byte-identical output to the recorded vectors.
+# Any divergence — KDF labels, AAD encoding, wire format — fails CI immediately
+# so cross-platform messaging breakage cannot land on main.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'test-vectors/**'
+      - 'packages/shade-core/tests/cross-platform-vectors.test.ts'
+      - 'packages/shade-core/src/**'
+      - 'packages/shade-crypto-web/src/**'
+      - 'packages/shade-proto/src/**'
+      - 'android/**'
+      - 'scripts/generate-vectors.ts'
+      - '.gitea/workflows/cross-vectors.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'test-vectors/**'
+      - 'packages/shade-core/tests/cross-platform-vectors.test.ts'
+      - 'packages/shade-core/src/**'
+      - 'packages/shade-crypto-web/src/**'
+      - 'packages/shade-proto/src/**'
+      - 'android/**'
+      - 'scripts/generate-vectors.ts'
+      - '.gitea/workflows/cross-vectors.yml'
+
+jobs:
+  ts-vectors:
+    name: TypeScript vectors (bun)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Bun
+        run: curl -fsSL https://bun.sh/install | bash
+
+      - name: Install dependencies
+        run: ~/.bun/bin/bun install --frozen-lockfile
+
+      - name: Run TS vector tests
+        run: ~/.bun/bin/bun run test:vectors
+
+      - name: Verify vectors are up-to-date
+        # Regenerate vectors and fail if they would change. Forces vector
+        # commits to come from `bun run vectors:gen`, never hand-edited.
+        run: |
+          ~/.bun/bin/bun run vectors:gen
+          if ! git diff --quiet test-vectors/; then
+            echo "::error::test-vectors/ is out of date. Run 'bun run vectors:gen' and commit."
+            git diff test-vectors/
+            exit 1
+          fi
+
+  kotlin-vectors:
+    name: Kotlin vectors (gradle)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Cache Gradle
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ hashFiles('android/**/*.gradle.kts', 'android/gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: gradle-
+
+      - name: Run Kotlin vector tests
+        working-directory: android
+        run: ./gradlew :shade-android:test --no-daemon --info
+
+      - name: Upload Gradle test report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: kotlin-test-report
+          path: android/shade-android/build/reports/tests/test/
+          if-no-files-found: ignore