Add 4.1.4 planning doc and release notes

PLAN-4.1.4.md

@@ -0,0 +1,25 @@
+# Stegasoo 4.1.4 Plan
+
+## Build / Deploy
+- [ ] Pre-built Python 3.12 venv tarball for Pi (skip 20+ min compile)
+- [ ] Fixed partition sizing in flash script (8-16GB rootfs for faster imaging)
+- [ ] Rename `flash-pi.sh` → `flash-stock-img.sh` for clarity
+- [ ] pip-audit integration in release validation
+
+## Features
+- [ ] QR channel key sharing (needs UI thought - avoid crowding encode/decode pages)
+- [ ] Role-based permissions: admin / mod / user
+- [ ] `stegasoo info` fastfetch-style command (version, service status, channel, CPU, temp, etc.)
+- [ ] Better capacity estimates / pre-flight check before encode fails
+
+## Security
+- [ ] Optional encryption for temp file storage (paranoid mode, config toggle)
+
+## Docs
+- [ ] Update UNDER_THE_HOOD.md
+- [ ] General docs refresh
+
+## Ideas (maybe later)
+- [ ] Stego detection tool
+- [ ] Browser extension
+- [ ] Pi snapshot/backup feature

RELEASE_NOTES.md

@@ -0,0 +1,34 @@
+## Stegasoo v4.1.3
+
+### Fixes
+- **SSL Certificate Generation**: First-boot wizard now properly generates self-signed certs when HTTPS is enabled
+- **Download Bug Fixed**: No more "File expired or not found" errors - fixed multi-worker temp file sharing
+- **Docker Build**: Reduced build context from 2.3GB to ~900KB
+
+### Improvements
+- Docker memory limits increased to 2GB (prevents OOM on large DCT operations)
+- Decode button now shows loading spinner during processing
+- Headless Pi flash script with Trixie/NetworkManager support
+
+### Docker
+```bash
+docker-compose up -d web  # Web UI on :5000
+docker-compose up -d api  # REST API on :8000
+```
+
+### Raspberry Pi Image
+Download `stegasoo-rpi-4.1.3.img.zst`, flash to SD card, and boot. The first-boot wizard will guide you through WiFi, HTTPS, and channel key setup.
+
+```bash
+# Flash with included script
+./rpi/flash-image.sh stegasoo-rpi-4.1.3.img.zst /dev/sdX
+
+# First time: save your WiFi credentials
+./rpi/inject-wifi.sh --setup
+
+# Then inject WiFi after flashing
+sudo ./rpi/inject-wifi.sh /dev/sdX
+```
+
+### Full Changelog
+See [CHANGELOG.md](CHANGELOG.md) for complete details.