release(v4.0.0): Shade GA — V3.x consolidation + audit prep

V3.1 → V3.12 consolidated and tagged for the first GA release. Wire
format unchanged from 0.4.x — 4.0 peers interoperate with 0.4.x peers
byte-for-byte. The version bump is semantic: audit-cycle complete,
opt-in surface fully exposed, threat model refreshed for every new
surface.

Highlights:
- All 24 @shade/* packages bumped to 4.0.0 in lockstep.
- CHANGELOG 4.0.0 section is the canonical manifest of what landed.
- THREAT-MODEL extended (§10 fingerprint gates, §11 WebRTC P2P, §12
  Web-Worker boundary) + residual-risks table refreshed.
- OpenAPI now covers all 27 routes: prekey, transfer, KT, inbox,
  bridge, observer, /metrics, /healthz, /ready.
- MIGRATION 0.3.x → 4.0 documented + smoke-tested against
  shade migrate-storage on a real SQLite DB.
- docs/audit/REVIEW-BUNDLE.md + SCOPE.md ready for external reviewer.
- scripts/soak.ts harness for the GA-stable 2-week soak window.
- All V*.md plans archived under docs/archive/ with Status: Done.
- Voice/Video carved out into V5.0; 4.0 audit focuses on the frozen
  non-realtime stack.

Tests: TS 1000/1000 + Kotlin 11/11 cross-platform vectors green.
Docker: gt.zyon.no/stian/shade-prekey:4.0.0 builds and reports
  version 4.0.0 on /health.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/shade-transport-webrtc/README.md

@@ -0,0 +1,48 @@
+# @shade/transport-webrtc
+
+V3.11 — direct peer-to-peer chunk transport for Shade transfers via
+`RTCDataChannel`. Plugs into `@shade/transfer`'s `ITransferTransport`
+contract and wires automatically into `@shade/sdk` via
+`shade.configureWebRTC()`.
+
+```ts
+import { createShade } from '@shade/sdk';
+import { nativeRtcFactory } from '@shade/transport-webrtc';
+
+const shade = await createShade({ prekeyServer });
+shade.configureWebRTC({ factory: nativeRtcFactory() });
+shade.configureTransfers({ resolveBaseUrl });
+
+await shade.upload({ to: 'bob', input: file });    // → P2P when NAT allows,
+                                                    //   HTTP otherwise.
+```
+
+See [docs/webrtc.md](../../docs/webrtc.md) for the full guide:
+NAT-traversal realities, TURN config, glare resolution, wire format,
+diagnostics, and end-to-end test recipes.
+
+## What's inside
+
+- `WebRtcConnection` — one peer connection between two Shade endpoints,
+  driving offer/answer/ICE through Shade's own ratchet.
+- `WebRtcConnectionManager` — per-peer pool with deterministic glare
+  resolution.
+- `WebRtcSignalingChannel` — JSON signaling messages multiplexed over
+  `Shade.send` / `Shade.onMessage`.
+- `WebRtcTransferTransport` — implements `ITransferTransport` over the
+  managed DataChannel; ack-correlated by 16-byte requestId tokens.
+- `MemoryRtcFactory` — in-process WebRTC simulator for tests.
+- `nativeRtcFactory()` — adapter over `globalThis.RTCPeerConnection`
+  (browsers / Deno / Cloudflare Workers).
+
+## Adapters
+
+`@shade/transport-webrtc` ships only the standard-API adapter
+(`nativeRtcFactory`). For Bun / Node, wrap your library of choice
+behind the `IRtcFactory` interface — only `createPeerConnection`,
+`createDataChannel`, and standard `addEventListener` are required.
+
+Recommended adapters:
+
+- [`node-datachannel`](https://github.com/murat-dogan/node-datachannel)
+- [`@roamhq/wrtc`](https://www.npmjs.com/package/@roamhq/wrtc)