docs(ui): finalize MVP plan structure and de-archaeologize topic docs

MVP web client (Phases 1-30) is complete; reorganize planning + living docs around that.

- PLAN.md kept as the staged MVP record (1-30) with a status block + pointers; removed the 31-36 stages, regression scenarios, and deferred-TODO section (moved out); fixed a stale cross-machine plan path.

- ui/PLAN-finalize.md (new): active web-finalization plan in 8 stages (visual system, a11y, i18n, error UX, PWA, build hygiene, docs, owner manual-QA loop); absorbs former Phases 33 and 35.

- ui/ROADMAP.md (new): post-MVP (Wails, Capacitor, realistic projection, acceptance + regression scenarios) and triaged deferred follow-ups.

- ui/docs/README.md (new): grouped topic-doc index.

- De-archaeologized all 20 ui/docs topic docs + ui/README.md + ui/core/README.md: stripped Phase-N build history, rewritten as current-state; deferred work now points at ROADMAP.md / PLAN-finalize.md. Docs-only; no code change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ui/docs/auth-flow.md

@@ -96,7 +96,7 @@ The keypair lives next to the id in the same database (object
 store `keypair`, key `device`). Clearing site data wipes both;
 the next load generates a fresh keypair and the user must log in
 again. This is the documented re-login path — there is no paired
-"reissue device session" flow in Phase 7.
+"reissue device session" flow.
 
 ## Browser support
 
@@ -105,25 +105,23 @@ Chrome ≥ 137, Firefox ≥ 130, Safari ≥ 17.4 (see
 [`storage.md`](storage.md) for the rationale). On boot the layout
 runs a sanity probe (`crypto.subtle.generateKey` for `Ed25519`); if
 it rejects, the layout switches to a `browser not supported` page
-instead of rendering `/login`. Phase 7 deliberately does not ship a
-JavaScript Ed25519 fallback — see Phase 6's "modern-browser baseline,
-no JS Ed25519 fallback" decision.
+instead of rendering `/login`. The client deliberately does not ship a
+JavaScript Ed25519 fallback — the design decision is modern-browser
+baseline only.
 
 ## Revocation
 
 The lobby layout opens a long-running `SubscribeEvents` stream as
-soon as `status` becomes `authenticated`. The watcher does not
-process individual events in Phase 7 — that arrives in Phase 24.
-Its only contract is liveness: any non-aborted termination of the
-stream is treated as a server-side session revocation, the watcher
-calls `session.signOut("revoked")`, and the layout effect redirects
-to `/login`.
+soon as `status` becomes `authenticated`. Its only contract is
+liveness: any non-aborted termination of the stream is treated as
+a server-side session revocation, the watcher calls
+`session.signOut("revoked")`, and the layout effect redirects to
+`/login`.
 
-This satisfies the Phase 7 acceptance bar of "session revocation
-closes the active client within one second": the gateway closes
-the stream the moment it observes a `session_invalidation` push
-event from backend, and the watcher reacts on the next event-loop
-tick.
+Session revocation closes the active client within one second: the
+gateway closes the stream the moment it observes a
+`session_invalidation` push event from backend, and the watcher
+reacts on the next event-loop tick.
 
 ## Localisation
 
@@ -140,8 +138,9 @@ drops JS-set `Accept-Language` headers. See
 adding a new language.
 
 The locale is **not** persisted between page reloads; detection
-runs again on every visit. Phase 35's full polish pass will
-revisit persistence and add message-format pluralisation.
+runs again on every visit. Persistence and message-format
+pluralisation are deferred to the finalization plan
+(../Plan-finalize.md).
 
 ## Configuration