docs: add STATUS/ROADMAP/FORMATS and update CLAUDE.md planning guidance

Introduce three new ALLCAPS.md tracking files:
- STATUS.md: living doc of in-flight work and what shipped in v0.5.0
- ROADMAP.md: full roadmap extracted from CLAUDE.md + expanded with all specced work
- FORMATS.md: wire-format quick-reference (.enc blobs, params.json, devices.json, etc.)

Update CLAUDE.md to replace the single-spec "Design spec" section with a
"Planning & design specs" section that instructs checking docs/superpowers/specs/
and docs/superpowers/plans/ before any planning or implementation work.
Also add the rule to update STATUS.md after every dev iteration, and replace
the stale v0.5.0-in-progress roadmap paragraph with references to the new files.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

STATUS.md

@@ -0,0 +1,56 @@
+# Relicario — Project Status
+
+> Update this file at the end of every dev iteration. It is the single source of truth for what is done, in progress, and next.
+
+## Version
+
+**Current tag:** v0.5.0 (2026-05-02)  
+**Active track:** v0.5.x UX polish + Plan B refactor continuation
+
+## What shipped in v0.5.0 (2026-05-02)
+
+Three release trains merged into one tag:
+
+**Security hardening (Plan A):**
+- Pre-receive hook actually verifies signatures now — device-auth was a no-op before (S1)
+- Backup-restore tar unpacking hardened against path traversal and zip-bomb (S2)
+- `RELICARIO_*` env-var surface audited; `RELICARIO_NO_GROUPS_CACHE` gated to debug builds (S3)
+
+**Bug fixes:**
+- Strength meter no longer goes stale after the regenerate button (B1)
+- Snake_case error codes no longer leak into the UI (B2)
+
+**Features (originally v0.3.0 + v0.4.0):**
+- `relicario backup export/restore` with `.relbak` format
+- `relicario import lastpass` (LastPass CSV importer)
+- Device authentication: ed25519 commit signing + Gitea deploy-key management
+- Fullscreen UX Phase 1: visual foundation (sidebar + pane shell, dark theme)
+- Fullscreen UX Phase 2A: smart inputs (password coloring, inline generator popover, custom-fields editor)
+
+## Recent work (post-v0.5.0, landed on main)
+
+**Plan B multi-stream refactor (2026-05-09 to present):**
+- `prompt_or_flag<T>` + builder compression — compressed `build_*_item` helpers (Stream A)
+- `Vault::after_manifest_change` wrapper, single canonical `ParamsFile` in session (Stream B)
+- Core/WASM seam: `base32_decode_lenient`, `parse_month_year`, `guess_mime` added to WASM exports; CLI parsers migrated to `relicario-core::parse` (Stream C)
+- CLI: `gen` alias for `generate`, `-l`/`-w` short flags, batched purge
+- `base32` module extracted from core, two duplicate RFC-4648 impls deduplicated
+- License switched to GPL-3.0-or-later
+
+## In progress (uncommitted on main)
+
+- Vault lock screen logo (`extension/src/vault/vault.ts`)
+- Vault container max-width constraint + list-pane width fix (`extension/src/vault/vault.css`)
+- README name fix (Aaron D. Lee)
+
+## Up next
+
+1. **Phase 2B: form layout polish** — spacing, density, section headers, attachment previews  
+   Spec: `docs/superpowers/specs/2026-05-02-phase-2b-form-layout-design.md`
+2. **1C-γ: attachments + Document type** — attachment UI in popup + vault tab; Document item add/view/edit  
+   Specs: `docs/superpowers/specs/2026-04-24-relicario-extension-1c-gamma{1,2}-design.md`
+3. **Phase 3: vault-tab shell** — sidebar nav + command palette stub  
+   Spec: `docs/superpowers/specs/2026-04-27-relicario-vault-tab-design.md`
+4. **Trash & history UI** — trash view, item/field-history viewer in vault tab
+
+See `ROADMAP.md` for the longer arc.