release(v4.0.0): Shade GA — V3.x consolidation + audit prep

V3.1 → V3.12 consolidated and tagged for the first GA release. Wire
format unchanged from 0.4.x — 4.0 peers interoperate with 0.4.x peers
byte-for-byte. The version bump is semantic: audit-cycle complete,
opt-in surface fully exposed, threat model refreshed for every new
surface.

Highlights:
- All 24 @shade/* packages bumped to 4.0.0 in lockstep.
- CHANGELOG 4.0.0 section is the canonical manifest of what landed.
- THREAT-MODEL extended (§10 fingerprint gates, §11 WebRTC P2P, §12
  Web-Worker boundary) + residual-risks table refreshed.
- OpenAPI now covers all 27 routes: prekey, transfer, KT, inbox,
  bridge, observer, /metrics, /healthz, /ready.
- MIGRATION 0.3.x → 4.0 documented + smoke-tested against
  shade migrate-storage on a real SQLite DB.
- docs/audit/REVIEW-BUNDLE.md + SCOPE.md ready for external reviewer.
- scripts/soak.ts harness for the GA-stable 2-week soak window.
- All V*.md plans archived under docs/archive/ with Status: Done.
- Voice/Video carved out into V5.0; 4.0 audit focuses on the frozen
  non-realtime stack.

Tests: TS 1000/1000 + Kotlin 11/11 cross-platform vectors green.
Docker: gt.zyon.no/stian/shade-prekey:4.0.0 builds and reports
  version 4.0.0 on /health.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/ROADMAP.md

@@ -0,0 +1,116 @@
+# Shade Roadmap — V3.1 → V5.0
+
+Indeks over versjonsplanene fra V3.1-grunnsteinen via **Shade 4.0 GA** og
+videre til **Shade 5.0** (Voice & Video).
+
+- **V4.0 GA** ✅ — alt fra V2.1 / V2.2 / V2.3 og bonus-tracket (sosial
+  recovery, P2P WebRTC, Pub/Sub, Key Transparency) er merget, testet,
+  dokumentert og pakket for ekstern review. Wire-formatet er låst.
+- **V5.0** = den dedikerte sanntids-releasen. *Alt* VOIP og videostreaming
+  ligger her — implementert oppå den frosne 4.0-stacken.
+
+Alle V3.x-planer ligger nå under [`docs/archive/`](./archive/) med
+`Status: Done`. Aktive planer: [`V5.0.md`](./V5.0.md).
+
+---
+
+## Faser
+
+### Fase 1 — Documentation & Hardening Foundation ✅
+
+| Plan | Tittel | Effort | Status |
+|------|--------|--------|--------|
+| [V3.1](./archive/V3.1.md) | Documentation & Hardening Foundation | S | **Done** |
+
+### Fase 2 — Sikkerhetsmodning ✅
+
+| Plan | Tittel | Effort | Status |
+|------|--------|--------|--------|
+| [V3.2](./archive/V3.2.md) | At-Rest Storage Encryption | L | **Done** |
+| [V3.3](./archive/V3.3.md) | Fingerprint Gates & Trust UX | M | **Done** |
+| [V3.4](./archive/V3.4.md) | Observability v2 (OpenTelemetry) | M | **Done** |
+| [V3.5](./archive/V3.5.md) | Android Parity & Cross-Platform CI | XL | **Done** |
+
+### Fase 3 — Plattformutvidelse ✅
+
+| Plan | Tittel | Effort | Status |
+|------|--------|--------|--------|
+| [V3.6](./archive/V3.6.md) | Async Store-and-Forward (Inbox) | L | **Done** |
+| [V3.7](./archive/V3.7.md) | Transport Bridge (SSE / long-poll) | M | **Done** |
+| [V3.8](./archive/V3.8.md) | Web Workers Crypto | M-L | **Done** |
+| [V3.9](./archive/V3.9.md) | Rich File Metadata & Previews | M | **Done** |
+
+### Fase 4 — Tillit og P2P-transport ✅
+
+| Plan | Tittel | Effort | Status |
+|------|--------|--------|--------|
+| [V3.10](./archive/V3.10.md) | Social Key Recovery | L | **Done** |
+| [V3.11](./archive/V3.11.md) | WebRTC P2P Transport | XL | **Done** |
+| [V3.12](./archive/V3.12.md) | Key Transparency | XXL | **Done** |
+
+### Fase 5 — General Availability ✅
+
+| Plan | Tittel | Effort | Status |
+|------|--------|--------|--------|
+| [V4.0](./archive/V4.0.md) | External Audit, Consolidation, GA | M | **Done** |
+
+### Fase 6 — Sanntid (post-GA)
+
+| Plan | Tittel | Effort | Avhenger av |
+|------|--------|--------|-------------|
+| [V5.0](./V5.0.md) | Voice & Video | XXL | V4.0 GA + V3.11 |
+
+---
+
+## Effort-nøkkel
+
+| Symbol | Tid |
+|--------|-----|
+| **S** | 1–2 uker |
+| **M** | 2–4 uker |
+| **L** | 4–8 uker |
+| **XL** | 2–4 måneder |
+| **XXL** | 4+ måneder / multi-quarter |
+
+---
+
+## Avhengighetsgraf
+
+```text
+V3.1 ────┬──► V3.2 ──┐
+         ├──► V3.3 ──┼──► V3.10 ──┐
+         ├──► V3.4 ──┘            │
+         ├──► V3.5 ───────────────┼──► V3.12 ──┐
+         ├──► V3.6 ──► V3.7 ──► V3.11 ─────────┤
+         ├──► V3.8                              ├──► V4.0 GA ──► V5.0 (Voice & Video)
+         └──► V3.9 ─────────────────────────────┘
+```
+
+---
+
+## Status-konvensjon
+
+Hver plan har et `Status:`-felt øverst. Lov verdier:
+
+- `Idea` — ikke startet, design fortsatt åpent.
+- `Design` — designnotat under arbeid eller approved.
+- `IMP` — implementasjon pågår.
+- `Done` — merget i main, dekket av tester.
+
+Når en plan blir `Done`, flytt fila til `docs/archive/` og oppdater denne tabellen.
+
+---
+
+## Versjonering
+
+- **V3.1 → V3.12** ble trinnvise minor-releases på `0.4.x`-linjen.
+- Wire-format-endringer akkumulerte til **V4.0**, men endte med å være
+  uendret fra 0.4.x — major-bumpen til 4.0 markerer audit-cycle ferdig
+  og GA-frosset kjerne, ikke en wire-bump.
+- **V4.0** er GA — låst kjerne, pakket for ekstern review, ingen
+  voice/video.
+- **V5.0** legger sanntid (voice/video/broadcast) oppå den frosne
+  4.0-stacken. Bygger på reserverte envelope-typer slik at 4.0-klienter
+  ignorerer 5.0-trafikk gracefully — ikke breaking.
+- Hver `V*`-merge oppdaterer `CHANGELOG.md` og bumper alle pakker via
+  `bun run version`.