docs: comprehensive update all docs to v0.0.46

11 files updated to reflect current state (v0.0.22 → v0.0.46):

ARCHITECTURE.md:
- Ring tones, group calls, read receipts, markdown rendering sections
- Bot API expanded (BotFather, numeric IDs, Telegram compat)
- Admin commands, known issues, 155 tests

TASK_PLAN.md:
- All P1-P4 marked DONE with version numbers
- Additional completed work section (bots, ETH, ring tones, group calls)
- New FC-P7 (Voice & Transport): cpal, Sender Keys, WebTransport
- FC-P6-T9/T10 added

PROGRESS.md:
- Full version history table v0.0.22 through v0.0.46
- Known issues section

README.md:
- Voice calls, ring tones, group calls, read receipts, markdown, 155 tests

SECURITY.md:
- Bot API security, voice call security, admin commands sections
- Updated protection tables

USAGE.md:
- Group calls, read receipts, markdown formatting, admin commands

CLIENT.md:
- Call commands, read receipts, markdown rendering

LLM_HELP.md + LLM_BOT_DEV.md:
- Call/group call/admin commands, ring tones, per-bot numeric IDs

TESTING_E2E.md:
- Tests 16-18: ring tones, group calls, admin commands

CLAUDE.md:
- Ring tone notes, group signal endpoint, MLS roadmap

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

warzone/docs/SECURITY.md

@@ -1,7 +1,7 @@
 # Warzone Messenger (featherChat) — Security Model & Threat Analysis
 
-**Version:** 0.0.21
-**Last Updated:** 2026-03-29
+**Version:** 0.0.46
+**Last Updated:** 2026-03-30
 
 ---
 
@@ -24,6 +24,8 @@
 | API write operations     | Bearer token middleware on all POST routes     |
 | Device sessions          | Kick/revoke-all, max 5 WS per fingerprint     |
 | Bot aliases              | Reserved suffixes (Bot/bot/_bot) enforced      |
+| DM call signaling        | E2E encrypted via WireMessage::CallSignal      |
+| Call room names          | Hashed (not plaintext) on relay                |
 
 ### What Is NOT Protected (Current)
 
@@ -37,6 +39,8 @@
 | Online/offline status    | Server knows when clients connect via WebSocket|
 | IP addresses             | Server sees client IP addresses                |
 | Bot messages             | Plaintext (not E2E) in v1 — bots don't hold ratchet sessions |
+| Group call media         | Transport-only (QUIC TLS), not E2E — MLS planned |
+| Admin commands           | No role-based auth yet (TODO: admin role system) |
 
 ### Trust Boundaries
 
@@ -374,6 +378,47 @@ The web client does not generate one-time pre-keys because `localStorage` cannot
 
 ---
 
+## Bot API Security
+
+Bot messages are **plaintext** in v1 — bots do not hold Double Ratchet sessions. This is a deliberate trade-off for simplicity.
+
+- **Per-bot numeric IDs:** The Bot API translates fingerprints to per-bot numeric user IDs. A bot never sees the real fingerprints of the users it communicates with, providing a privacy layer between bots and users.
+- **BotFather token storage:** Bot tokens are stored in the server's sled database as `bot:<token>` entries. Tokens are generated server-side with 16 random bytes (32 hex characters). Treat tokens as secrets.
+- **Plaintext v1:** Bot messages travel as plaintext between the client and server. The client auto-detects bot aliases (suffixes `Bot`, `bot`, `_bot`) and skips E2E encryption. Future versions may support bot-side ratchet sessions.
+
+---
+
+## Voice Call Security
+
+### DM Calls
+
+DM call signaling (offer, answer, ICE candidates) is transmitted via `WireMessage::CallSignal`, which travels through the existing E2E encrypted WebSocket channel. The signaling is encrypted with the Double Ratchet session between the two peers — the server cannot read call setup metadata.
+
+### Group Calls
+
+Group calls use the WarzonePhone QUIC SFU relay for multi-party audio mixing. Media is encrypted in transit via QUIC TLS (transport-layer encryption), but is **not E2E encrypted** — the relay can observe audio streams.
+
+**MLS planned:** Future versions will use Message Layer Security (RFC 9420) for E2E encrypted group call media, where the relay handles only opaque ciphertext.
+
+### Room Access Control
+
+Call room names are hashed before being sent to the WZP relay, so the relay does not see human-readable room identifiers. The relay enforces ACL checks using the featherChat bearer token for room join authorization.
+
+---
+
+## Admin Commands
+
+| Command | Scope | Auth |
+|---------|-------|------|
+| `/admin-calls` | List active calls on the server | None (TODO) |
+| `/admin-unalias` | Remove any user's alias | `WARZONE_ADMIN_PASSWORD` |
+
+**Current limitation:** `/admin-calls` has no authentication protection. Any connected client can invoke it. A proper admin role system (role assignment, challenge-based admin auth) is planned but not yet implemented.
+
+`/admin-unalias` requires the `WARZONE_ADMIN_PASSWORD` environment variable to be set on the server and the client to provide the matching password.
+
+---
+
 ## Known Weaknesses and Mitigations Planned
 
 ### 1. No Sealed Sender