docs: sync STATUS / ROADMAP / extension ARCHITECTURE with shipped work

Punch items from doc audit:
- STATUS: "in progress" section was carrying ghost items (vault
  container max-width, README name fix) with no matching commits or
  working-tree changes; trimmed to the one real in-flight item.
- STATUS + ROADMAP: trash/history/devices/settings management-surfaces
  revamp shipped 2026-05-24..05-30 (commits c943a06..88d7228) but was
  still listed as "up next" / medium-term; moved to shipped with
  per-commit SHAs.
- STATUS: v0.5.0 was described as the current tag, but only v0.2.0 and
  four plan-1* tags exist; rephrased as "v0.5.0 train on main, untagged".
- ROADMAP: "Vault lock screen + container polish (in progress)"
  collapsed to just the lock-screen logo (the only real in-flight item).
- extension/ARCHITECTURE: module map missing four shipped components —
  popup/components/form-header.ts, popup/components/settings-security.ts,
  vault/components/backup-panel.ts (#backup route),
  vault/components/import-panel.ts (#import route); all added with
  matching #backup / #import route entries.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

extension/ARCHITECTURE.md

@@ -138,6 +138,10 @@ before any new render.
   `renderConcealedRow`, `renderSignatureBlock`, `renderSections*`)
   consumed by every type. Mounting is the caller's job; after mount,
   `wireFieldHandlers(scope)` binds the reveal/copy click handlers once.
+- `form-header.ts` — extracted `renderFormHeader({ title, subtitle, ...})`
+  helper used by every type's `renderForm` (shared `.form-header` CSS,
+  static "esc to cancel" subtitle in fullscreen mode). Takes an options
+  object so callers don't need to remember positional argument order.
 - `generator-panel.ts` — inline password / passphrase generator. Mounts
   inside any host element; round-trips knob changes through the SW's
   `generate_password` / `generate_passphrase` (debounced 150ms). Has two
@@ -150,10 +154,17 @@ before any new render.
   bytes via WASM (defense in depth — see
   `router/popup-only.ts:223-228`).
 - `settings.ts` — device-local UX settings (capture toggle, prompt
-  style), trash/devices/sync-now buttons, blacklist editor.
+  style), trash/devices/sync-now buttons, blacklist editor. Revamped in
+  commit `299e7db` to split synced (vault) vs local (device) sections
+  and surface the per-device session-timeout UI (radio + minutes input).
 - `settings-vault.ts` — vault-wide settings (retention, generator
   defaults, autofill origin acks). Reads/writes via the SW's
   `get_vault_settings` / `update_vault_settings`.
+- `settings-security.ts` — security sub-pane of the vault-tab settings
+  shell: three-state recovery QR display (hidden → revealed → printed)
+  and an inline devices summary. Mounted from the settings left-nav.
+  Restored from main in commit `8baef5b` after the Stream C real
+  implementation landed.
 - `trash.ts` — soft-delete listing with per-item purge countdown
   (via `shared/relative-time.ts::daysUntilPurge`), glyph restore (`⤺`),
   and a bottom-right destructive "empty trash" button.
@@ -178,16 +189,30 @@ before any new render.
 
 - `vault.ts` — fullscreen tab entry. Hash-based router (`#detail/<id>`,
   `#add/<type>`, `#trash`, `#devices`, `#settings`, `#settings-vault`,
-  `#history`, `#history/<id>`). Legacy `#field-history/<id>` URLs are
-  normalized to `#history/<id>` on `parseHash`; the internal view value
-  stays `'field-history'` so the per-item pane renders unchanged.
-  Sidebar bottom-nav: `+ new item · ▦ trash · ⌬ devices · ⚙ settings ·
-  ◷ history · ⏻ lock`. Registers itself as the StateHost so all
+  `#history`, `#history/<id>`, `#backup`, `#import`). Legacy
+  `#field-history/<id>` URLs are normalized to `#history/<id>` on
+  `parseHash` (`vault.ts:139-173`); the internal view value stays
+  `'field-history'` so the per-item pane renders unchanged. Sidebar
+  bottom-nav: `+ new item · ▦ trash · ⌬ devices · ⚙ settings · ◷ history
+  · ⏻ lock`. Registers itself as the StateHost so all
   `popup/components/*` renderers run unchanged. Maintains its own
   `selectedItem` cache so hash navigation between already-loaded items
   doesn't refetch.
 - `vault.html` / `vault.css` — sidebar + pane layout.
 
+### `src/vault/components/`
+
+Vault-tab-only panes (popup is too small for these workflows). Each
+exports `render…(app)` and a `teardown()`, same convention as
+`popup/components/*`.
+
+- `backup-panel.ts` — `.relbak` export / restore UI. Routable as
+  `#backup` (vault.ts case at :167). Drives the SW's backup handlers;
+  the actual tar packing happens in `relicario-core` via WASM exports.
+- `import-panel.ts` — LastPass CSV importer surface. Routable as
+  `#import` (vault.ts case at :168). Parses CSV client-side and pipes
+  parsed rows through `add_item` SW messages.
+
 ### `src/setup/`
 
 - `setup.ts` (1137 lines) — the wizard state machine. Six steps