docs(ux): inscribe QR/deeplink onboarding decision + V4 security constraints

[Davincc77]

Summary

Docs-only PR that inscribes the maintainer-validated decision (2026-05-24, Vince) on QR / deeplink onboarding for .klickd v4 and the security constraints that surround it. Follows the merge of #36 (SHA 27e53be44cf512c0420143c2e36bef2b39d4d9a1).

The previous R4-P1-5 entry in docs/roadmap/ROAD-TO-V4-GA.md listed three open alternatives (a/b/c). Vince validated the direction: QR / deeplink is a trigger for the import / resume UI, never a transport for secrets. This PR closes that decision and writes it down.

Changes

• docs/ux/V4-ONBOARDING-QR-DEEPLINK.md (new, NON-NORMATIVE) — load-bearing decision:
  • Trigger-only. A QR / deeplink MUST NOT carry raw .klickd content, passphrase, durable token, or permanent public link to a .klickd file.
  • Preferred zero-server flows: custom URI scheme klickd://import and stateless HTTPS launcher https://klickd.app/import-klickd (PWA / WASM, decryption client-side via Web Crypto / hash-wasm Argon2id). User then picks the local file and enters the passphrase locally — same path as R4-P0-1.
  • Conditional future server-temporary URL (NOT V4 P0) gated behind seven constraints (C1–C7): encrypted file only, short TTL ≤ 10 min, one-time use, no passphrase or raw payload transported, explicit per-transfer consent, no durable sender/receiver identifier, RFC Accepted before shipping.
  • Classification table: local import + reload verification = V4 P0 (unchanged, R4-P0-1); klickd://import and HTTPS launcher = P1 conditional; server-temporary URL = P2 conditional + future RFC; QR / deeplink transporting raw payload or passphrase = REJECTED (anti-pattern A3).
  • Security constraints summary: untrusted-input handling, never auto-decrypt on receipt, trigger budget ≤ 256 bytes, surface resolved scheme/host (consent-first per V4-UX-SPEC.md P3), metadata-only audit logs.
• docs/roadmap/ROAD-TO-V4-GA.md §2.4 R4-P1-5 — replace the placeholder a/b/c decision with the inscribed decision and cross-link the new spec. P1 conditional → P2 if zero-server architecture review blocks is preserved.

Strict governance respected

• No SPEC / schema / SDK / vector / wire-format change.
• No publish (npm / PyPI / Zenodo / IANA).
• No tag / release.
• No package version bump.
• No locked_* field touched.
• No destructive change.
• V4 Acceptance Checklist unchanged.
• P0 remains exactly local import + reload verification (R4-P0-1).

Test plan

• Local docs heading structure verified.
• Python vectors: python verify_vectors.py → 59/59 passed (0 failed).
• CI klickd Cross-Impl Test Vectors green on this branch.
• Reviewer confirms the inscribed decision matches the maintainer-validated direction (QR / deeplink = trigger, never transport).

🤖 Generated with Claude Code