docs: realign blueprint with shipped state + add feature/journey/ideas docs

- PROJECT.md, README.md, TEST_GUIDE.md: status line refreshed; rate-limiter
  doc-vs-code drift fixed; HTML export section rewritten for the SvelteKit-
  static viewer; SSE event names + new events documented; config seed block
  extended with planned toggles + privacy_note; decision log entries added.
- docs/CONCEPT_HTML_VIEWER.md, docs/CONCEPT_MOBILE_UI.md: banner the design
  intent as shipped; point at the source-of-truth code paths.
- docs/CONCEPT_DIASHOW.md: planned-then-shipped design for the live diashow
  (two-queue policy, pluggable transitions, data-mode aware).
- docs/FEATURES.md: capability matrix by role (Guest / Host / Admin) plus
  prose per area (auth, posting, feed, moderation, admin, export, gestures,
  data mode, quotas, privacy note, extensibility).
- docs/USER_JOURNEYS.md: step-by-step flows for every supported scenario,
  including PIN reset by host, data mode, privacy note, gestures, and the
  admin toggles.
- docs/IDEAS.md: speculative extensions (global diashow, reactions,
  multi-tenancy, animation pack, etc.) — explicitly out of v0.16 scope.
- backend/migrations/README.md, frontend/src/lib/README.md: codify the
  "never edit a shipped migration" rule and the lib/ conventions
  (one store per concern, gestures via actions, sheets via ContextSheet,
  transitions as drop-in components).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/lib/README.md

@@ -0,0 +1,34 @@
+# `lib/` conventions
+
+Short rules. The patterns we already follow as of v0.16 — write new code that fits.
+
+**One store per cross-cutting concern.** A single `*-store.ts` file owns each one:
+- `auth.ts` — JWT / PIN in `localStorage`, `isAuthenticated` writable
+- `ui-store.ts` — bottom-nav visibility, upload-sheet open state, FAB badge count
+- `data-mode-store.ts` — Saver vs Original media-loading preference
+- `privacy-note-store.ts` — admin-configured Datenschutzhinweis text
+- `quota-store.ts` — live per-user storage snapshot
+- `upload-queue.ts` — IndexedDB-persisted upload queue + processing state
+
+Don't import these into other stores unless strictly necessary; let pages compose them.
+
+**DTOs mirror Rust types.** All TS interfaces live in `types.ts`. Each one carries a
+`// mirrors backend/src/path::TypeName` comment so the two stay searchable. If you add
+a Rust DTO, add the TS twin in the same PR.
+
+**Gestures via Svelte actions in `actions/`.** Long-press, double-tap, future swipe —
+each is a `use:` action that fires a CustomEvent. Components stay free of gesture
+plumbing.
+
+**Reusable bottom sheets via `ContextSheet.svelte`.** Pass an `actions: ContextAction[]`
+array. Any page that needs a long-press / kebab context menu uses the same primitive.
+
+**SSE relays are listed in `sse.ts::KNOWN_EVENTS`.** New server event → add one entry
+to that array, that's it.
+
+**Diashow transitions live in `diashow/transitions/`.** Each is a Svelte component
+plus one entry in `transitions/index.ts`. Adding a new animation is two-line work; no
+diashow code needs to change.
+
+**No new global stores** beyond the list above unless the new concept is genuinely
+app-wide. Page state belongs in the page.