docs(user): add user_docs/ end-user guide (12 pages)

A friendly, task-oriented guide for non-technical users: README index,
getting-started, concepts, items, passwords-and-generators, totp,
attachments-and-documents, organizing, sync-and-backup, the-browser-extension,
recovery, faq. Every command/flag derived from the actual CLI surface
(`relicario --help` tree) and real extension behavior — no invented flags.
Org item-type parity is covered high-level pending the v0.8.1 B/C merge
(two TODO markers left for the rebase).

user_docs/organizing.md

@@ -0,0 +1,162 @@
+# Organizing your vault: groups, tags, favorites, and search
+
+This page covers how to keep your vault tidy as it grows — sorting items into groups,
+tagging them for cross-cutting labels, marking favorites, and finding things quickly.
+
+---
+
+## Groups — one folder-like label per item
+
+A **group** is a single label that acts like a folder. Every item can belong to at most
+one group. Use groups for broad categories (a room in the house, a project, a person in
+the family).
+
+**Set a group when adding an item:**
+
+```
+relicario add login --title "Home router" --username admin --group Home
+relicario add card --title "Visa credit" --group Finance
+```
+
+**Change a group on an existing item:**
+
+Run `relicario edit <title-or-id>` and, when prompted for the group field, type the new
+value (or press Enter to keep the current one).
+
+**List items in a group:**
+
+```
+relicario list --group Home
+relicario list --group Finance
+```
+
+Group names are case-sensitive, so be consistent — `Home` and `home` are different groups.
+
+---
+
+## Tags — multiple labels per item
+
+**Tags** let you attach several labels to one item — useful when a single item fits more
+than one category. A login for your bank's app might belong to the `Finance` group and
+also carry tags `mobile` and `2fa-enabled`.
+
+**Set tags when adding an item** (comma-separated, no spaces around commas):
+
+```
+relicario add login --title "Bank mobile app" \
+    --username me@example.com \
+    --group Finance \
+    --tags mobile,2fa-enabled
+```
+
+**Change tags on an existing item:**
+
+Run `relicario edit <title-or-id>` and update the tags field when prompted.
+
+**Filter by tag:**
+
+```
+relicario list --tag mobile
+relicario list --tag 2fa-enabled
+```
+
+Only one tag at a time can be passed to `--tag`, but you can combine tag filtering with
+group and type filters (see [Combining filters](#combining-filters) below).
+
+---
+
+## Favorites — quick-access marker for login items
+
+Login items support a `--favorite` flag. Mark an item as a favorite when you add it:
+
+```
+relicario add login --title "Gmail" --username me@example.com --favorite
+```
+
+This is a quick-access marker — it shows up in the browser extension's favorites view so
+your most-used logins are always one click away.
+
+> To toggle a favorite on an existing login, run `relicario edit <title-or-id>` and
+> update the favorite field when prompted.
+
+---
+
+## Finding things
+
+### Find by title substring — `relicario get`
+
+`relicario get` accepts a title substring (case-insensitive) or an exact item id:
+
+```
+relicario get bank         # finds any item whose title contains "bank"
+relicario get a3f2c1      # finds the item with that id
+```
+
+Secrets are masked by default. Pass `--show` to reveal them, or `--copy` to copy the
+primary secret (Login password, Card number, etc.) to the clipboard — it clears
+automatically after 30 seconds.
+
+### Filter the full list — `relicario list`
+
+`relicario list` prints every item. Narrow it down with flags:
+
+| Flag | What it filters |
+|---|---|
+| `--type <TYPE>` | Item type: `login`, `secure-note`, `identity`, `card`, `key`, `document`, `totp` |
+| `--group <GROUP>` | Items in that group |
+| `--tag <TAG>` | Items carrying that tag |
+| `--trashed` | Trashed (soft-deleted) items only |
+
+### Combining filters
+
+All filters can be combined in one command:
+
+```
+# All login items in the Finance group tagged "2fa-enabled"
+relicario list --type login --group Finance --tag 2fa-enabled
+
+# Every trashed item in the Work group
+relicario list --group Work --trashed
+```
+
+---
+
+## A suggested scheme (non-prescriptive)
+
+There is no one right answer, but here is a pattern that works well for a household or
+small team:
+
+**Groups → broad areas of life.** Think of them like drawers:
+- `Home` — router, smart devices, alarm panel
+- `Finance` — bank accounts, investment logins, card numbers
+- `Work` — corporate VPN, project tools, SSH keys
+- `Personal` — social accounts, streaming services, email
+
+**Tags → cross-cutting traits** that apply across groups:
+- `2fa-enabled` — logins that have TOTP set up
+- `shared` — items you share with a family member
+- `critical` — accounts you would be in serious trouble losing
+
+**Favorites → your daily drivers.** Mark the five or ten logins you open every day.
+They surface at the top in the extension so you do not have to search.
+
+This keeps groups stable (you rarely add a new drawer) while tags stay flexible (add new
+ones whenever a new trait comes up).
+
+---
+
+## Shell-completion tip
+
+If you build the optional shell completions, `--group` autocompletes from a local cache
+that Relicario maintains. Run:
+
+```
+relicario completions bash > /etc/bash_completion.d/relicario   # bash
+relicario completions zsh > ~/.zfunc/_relicario                  # zsh
+```
+
+After that, pressing Tab after `--group` suggests your existing group names.
+
+---
+
+**Next:** [Sync & backup](sync-and-backup.md)