Issue #3594111: Document the owner-passphrase feature

Frank Mablyrequested to merge
issue/pdv-3594111:3594111-docs into 1.x

Follow-up to MR !32 (merged) (owner passphrase, #3594111), which merged without documentation coverage.

Adds the feature across the docs site:

  • concepts.md - new section on the two-layer wrap (passphrase-derived Argon2id key under the Master KEK), per-subject gating, the protect-against-the-operator threat model, and the no-recovery / consumer-absent consequences.
  • owner-guide.md - how to enable, unlock, change and disable the passphrase from the Advanced section, with the no-recovery warning.
  • cross-site-api.md - a Locked vaults section: the vault_locked fail-closed signal and the split-key unlock handoff (one-time code, Ks encrypted under a code-derived key, single-use, consumer-bound).
  • roadmap.md - move the owner passphrase out of planned into the shipped foundation summary (the old planned blurb also described a per-item design that does not match the shipped per-subject gating).

Verified with mkdocs build --strict (all cross-page anchors resolve).

Merge request reports