release(v4.0.0): Shade GA — V3.x consolidation + audit prep

V3.1 → V3.12 consolidated and tagged for the first GA release. Wire
format unchanged from 0.4.x — 4.0 peers interoperate with 0.4.x peers
byte-for-byte. The version bump is semantic: audit-cycle complete,
opt-in surface fully exposed, threat model refreshed for every new
surface.

Highlights:
- All 24 @shade/* packages bumped to 4.0.0 in lockstep.
- CHANGELOG 4.0.0 section is the canonical manifest of what landed.
- THREAT-MODEL extended (§10 fingerprint gates, §11 WebRTC P2P, §12
  Web-Worker boundary) + residual-risks table refreshed.
- OpenAPI now covers all 27 routes: prekey, transfer, KT, inbox,
  bridge, observer, /metrics, /healthz, /ready.
- MIGRATION 0.3.x → 4.0 documented + smoke-tested against
  shade migrate-storage on a real SQLite DB.
- docs/audit/REVIEW-BUNDLE.md + SCOPE.md ready for external reviewer.
- scripts/soak.ts harness for the GA-stable 2-week soak window.
- All V*.md plans archived under docs/archive/ with Status: Done.
- Voice/Video carved out into V5.0; 4.0 audit focuses on the frozen
  non-realtime stack.

Tests: TS 1000/1000 + Kotlin 11/11 cross-platform vectors green.
Docker: gt.zyon.no/stian/shade-prekey:4.0.0 builds and reports
  version 4.0.0 on /health.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/shade-transport-webrtc/src/shade-bridge.ts

@@ -0,0 +1,54 @@
+/**
+ * SDK glue. The {@link createShadeBridgeFromShade} helper turns any Shade-
+ * shaped object into a {@link ShadeBridge} suitable for
+ * `WebRtcSignalingChannel`. Kept in its own file so the package can be
+ * consumed standalone (e.g. by tests with a memory bridge) without
+ * pulling in the full SDK type tree.
+ */
+
+import type { ShadeBridge } from './signaling.js';
+
+/**
+ * Minimal shape of `Shade` we depend on. The real `@shade/sdk` `Shade`
+ * class satisfies this structurally; declaring it locally avoids a
+ * circular dependency on `@shade/sdk` in this package's `package.json`.
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export interface ShadeLike {
+  readonly myAddress: string;
+  // The real SDK returns a `ShadeEnvelope`; we accept anything because the
+  // bridge just hands it back to `deliverControlEnvelope`.
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  send(address: string, plaintext: string): Promise<any>;
+  onMessage(handler: (from: string, plaintext: string) => void | Promise<void>): () => void;
+  /**
+   * Optional. When present (the real SDK provides it), the bridge calls
+   * `deliverControlEnvelope` after `send()` so the encrypted envelope
+   * actually reaches the peer over HTTP. When absent (memory tests or
+   * custom transports), `send()` alone is enough.
+   */
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  deliverControlEnvelope?: (peer: string, envelope: any) => Promise<void>;
+}
+
+/**
+ * Adapt a `Shade`-shaped instance to the {@link ShadeBridge} interface used
+ * by `WebRtcSignalingChannel`. Each `bridge.send` calls
+ * `shade.send(plaintext)` to ratchet-encrypt the signaling JSON, then —
+ * when available — `shade.deliverControlEnvelope(...)` to actually ship the
+ * envelope to the peer.
+ */
+export function createShadeBridgeFromShade(shade: ShadeLike): ShadeBridge {
+  return {
+    myAddress: shade.myAddress,
+    async send(peerAddress: string, plaintext: string): Promise<void> {
+      const envelope = await shade.send(peerAddress, plaintext);
+      if (shade.deliverControlEnvelope !== undefined) {
+        await shade.deliverControlEnvelope(peerAddress, envelope);
+      }
+    },
+    onMessage(handler) {
+      return shade.onMessage(handler);
+    },
+  };
+}