docs: bring all documentation current with shipped work

A multi-agent audit of every doc against the code surfaced ~50 stale/missing
items (the roadmap/status docs and the backlog had fallen behind the code).
This catches them up:

- CLAUDE.md: phase status was ~3 phases stale ("Phase 1 is next" while Phase 1 +
  chunks of 2 & 4 shipped). Rewrote the status list; added a model-provider
  tech-stack entry; updated repo-layout (integrations objectstore/models,
  deploy backup.sh/dev compose).
- ARCHITECTURE.md: §6 privacy engine described 3 visibility levels — corrected to
  the shipped 4 (adds site_members); documented per-tree AI policy on Tree,
  LLMProvider/EmbeddingProvider split + registry, ChangeProposal origin/status/
  operations, verified-email session gate, instance-owner role, schema-drift
  guard, and the env_file config model.
- PRD.md: 4-level visibility in US-040/§5.5, instance-owner role (§5.1/§5.11),
  per-tree AI policy (§5.8), §8 sequencing annotated with shipped status, header
  date/status bumped.
- README.md: 4-level privacy; softened "Full GEDCOM 7" to the 5.5.1/7 common
  subset; noted backups + instance-owner admin; moved property/land to an
  explicit "where it's headed" (no property models exist yet).
- BACKLOG.md: flipped ~15 shipped-but-open rows to Have (ChangeProposal, provider
  abstraction, GEDCOM citation export, membership management, operator backup,
  email-verification gate, per-tree AI policy, instance owner, the whole
  visibility/public-viewing/child-resource-redaction cluster #41-#51/#46), and
  reconciled the executive summary, "current defects" list, quick wins, and
  differentiators. Left genuinely-open items (citation/source redaction, sitemap,
  per-tree noindex, scoped-token API) accurately open.
- .env.example: dropped "SMTP wired in a later phase"; documented the worker
  purge knobs, S3_PRESIGN_TTL, COOKIE_NAME; removed a stray duplicate line.
- design/: tree-visibility.md and change-proposal.md marked Shipped; corrected
  the redaction approach (reuses member schemas, not a separate PublicPersonRead)
  and the apply() rollback claim (v1 is not cross-op transactional), and marked
  rate-limiting/sitemap/noindex as deferred.

No code changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

deploy/.env.example

@@ -35,6 +35,8 @@ S3_BUCKET=provenance
 S3_ACCESS_KEY=provenance
 S3_SECRET_KEY=change-me-too
 S3_REGION=us-east-1
+# Presigned media URL lifetime in seconds.
+S3_PRESIGN_TTL=3600
 
 # --- Edge (Caddy) ---
 # Local: ':80' (http://localhost). Production: 'provenance.example.com' for auto-HTTPS.
@@ -52,6 +54,8 @@ COMPOSE_PROFILES=
 # --- Auth / sessions ---
 SESSION_TTL_DAYS=30
 TOKEN_TTL_HOURS=24
+# Name of the session cookie.
+COOKIE_NAME=provenance_session
 # Set false for local http; true (default) behind TLS.
 COOKIE_SECURE=false
 # Base URL used to build links in outbound email.
@@ -62,13 +66,20 @@ MAILER=console
 # until SMTP works and existing accounts are verified, or you will lock users out.
 REQUIRE_EMAIL_VERIFICATION=false
 
-# --- Email (SMTP) — wired in a later phase ---
+# --- Email (SMTP) ---
+# Active when MAILER=smtp (above) and SMTP_HOST is set.
 SMTP_HOST=
 SMTP_PORT=587
 SMTP_USERNAME=
 SMTP_PASSWORD=
 SMTP_FROM=
 
+# --- Worker (soft-delete purge) ---
+# How often the purge job runs, and how old a soft-deleted row must be before it
+# is permanently removed (and its media objects cleaned up).
+PURGE_INTERVAL_SECONDS=3600
+PURGE_AFTER_DAYS=30
+
 # --- Model providers (AI assistant + embeddings) -----------------------------
 # Configure as many as you like — each turns on when its key is set. The
 # default_* vars pick which one is used by default; the app can also select any
@@ -99,4 +110,3 @@ OLLAMA_ENABLED=false
 OLLAMA_BASE_URL=http://localhost:11434/v1
 OLLAMA_MODEL=llama3.1
 OLLAMA_EMBEDDING_MODEL=nomic-embed-text
-# XAI_API_KEY=