release(v4.0.0): Shade GA — V3.x consolidation + audit prep

V3.1 → V3.12 consolidated and tagged for the first GA release. Wire
format unchanged from 0.4.x — 4.0 peers interoperate with 0.4.x peers
byte-for-byte. The version bump is semantic: audit-cycle complete,
opt-in surface fully exposed, threat model refreshed for every new
surface.

Highlights:
- All 24 @shade/* packages bumped to 4.0.0 in lockstep.
- CHANGELOG 4.0.0 section is the canonical manifest of what landed.
- THREAT-MODEL extended (§10 fingerprint gates, §11 WebRTC P2P, §12
  Web-Worker boundary) + residual-risks table refreshed.
- OpenAPI now covers all 27 routes: prekey, transfer, KT, inbox,
  bridge, observer, /metrics, /healthz, /ready.
- MIGRATION 0.3.x → 4.0 documented + smoke-tested against
  shade migrate-storage on a real SQLite DB.
- docs/audit/REVIEW-BUNDLE.md + SCOPE.md ready for external reviewer.
- scripts/soak.ts harness for the GA-stable 2-week soak window.
- All V*.md plans archived under docs/archive/ with Status: Done.
- Voice/Video carved out into V5.0; 4.0 audit focuses on the frozen
  non-realtime stack.

Tests: TS 1000/1000 + Kotlin 11/11 cross-platform vectors green.
Docker: gt.zyon.no/stian/shade-prekey:4.0.0 builds and reports
  version 4.0.0 on /health.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/shade-inbox-server/src/store.ts

@@ -0,0 +1,87 @@
+/**
+ * InboxStore — server-side storage interface for the async store-and-forward
+ * relay (V3.6).
+ *
+ * The relay stores ciphertext blobs only. It never sees plaintext, never
+ * holds private keys, and never decrypts anything. The address-owner table
+ * binds an address to a recipient signing key (Ed25519) so GET/DELETE
+ * authentication can verify that the caller actually owns the address.
+ *
+ * Per-blob row layout (mandated by V3.6 spec):
+ *   address || msgId || ciphertext-bytes || expires_at
+ *
+ * `received_at` is also stored per blob to support cursor-based GET. The
+ * cursor is opaque to the caller — it is just the highest `received_at`
+ * the client has seen, encoded as a string.
+ */
+export interface InboxStore {
+  // ─── Address ownership (TOFU on first register) ───────────
+
+  /**
+   * Register or update the signing key that owns `address`. First call
+   * "claims" the address (TOFU). Subsequent calls with the same key are
+   * no-ops. A different key trying to claim the same address is rejected
+   * by the route layer (the store itself just upserts).
+   */
+  saveAddressOwner(address: string, signingKey: Uint8Array): Promise<void>;
+
+  /** Look up the owner signing key for `address`, or null if unregistered. */
+  getAddressOwner(address: string): Promise<Uint8Array | null>;
+
+  // ─── Blob CRUD ───────────────────────────────────────────
+
+  /**
+   * Store an inbox blob.
+   *
+   * **Idempotent**: if a row already exists for `(address, msgId)` the
+   * implementation MUST return `{ created: false }` and leave the existing
+   * row untouched. A fresh insert returns `{ created: true, receivedAt }`.
+   */
+  putBlob(args: {
+    address: string;
+    msgId: string;
+    ciphertext: Uint8Array;
+    expiresAt: number;
+  }): Promise<{ created: boolean; receivedAt: number }>;
+
+  /**
+   * Fetch all non-expired blobs for `address` whose `received_at > sinceCursor`,
+   * ordered ascending by `received_at`. The caller passes 0 (or `null`-equiv
+   * "")  to fetch from the beginning.
+   *
+   * Implementations must filter out expired rows so a slow consumer never
+   * sees a payload past TTL. Pruning of expired rows happens out-of-band.
+   */
+  fetchBlobs(args: {
+    address: string;
+    sinceCursor: number;
+    now: number;
+    limit: number;
+  }): Promise<Array<{ msgId: string; ciphertext: Uint8Array; receivedAt: number; expiresAt: number }>>;
+
+  /**
+   * Delete a single blob by `(address, msgId)`. Returns true if a row was
+   * removed. Used by clients to ack a fetched message for early prune.
+   */
+  deleteBlob(address: string, msgId: string): Promise<boolean>;
+
+  /**
+   * Count non-expired blobs for `address`. Used by quota enforcement and
+   * the inbox-fanout fingerprint gate.
+   */
+  countBlobs(address: string, now: number): Promise<number>;
+
+  // ─── Maintenance ─────────────────────────────────────────
+
+  /**
+   * Purge every blob whose `expires_at <= now`. Returns count removed.
+   * Called periodically by a cron task.
+   */
+  purgeExpired(now: number): Promise<number>;
+
+  /**
+   * Drop the address owner record and any remaining blobs for `address`.
+   * Used by the unregister route.
+   */
+  deleteAddress(address: string): Promise<void>;
+}