Expand all README files for firmware 0.8.3.

Align root, Software, and Firmware READMEs with security, CI, web UI, blob policy, and six-band EQ details.

Co-authored-by: Cursor <cursoragent@cursor.com>

Software/README.md

@@ -2,9 +2,37 @@
 
 Open-source Hi-Fi DAB+/FM receiver firmware for the ESP32-S3.
 
-**Status:** fw **0.8.3** — NVS + flash encryption (dev mode); tabbed Web UI;
-`IntegrationService`; **13** host tests; CI on `main`.
-See [`docs/TODO.md`](docs/TODO.md) for the agent task list.
+**Status:** fw **0.8.3** on `main` — NVS + flash encryption (development mode),
+tabbed Web UI, `IntegrationService`, RDS/DLS metadata, **13** host tests, **4** CI
+jobs. Agent tasks T1–T8 complete; device HIL pending first PCB.
+
+| Area | Shipped in 0.8.3 |
+|------|------------------|
+| Boot | Si4684 HOST_LOAD, ADAU1701 RAM program, BT1035 Line-In init |
+| Tuner | FM/DAB tune, seek, RSQ, RDS, DAB services + DLS |
+| Audio | 6-band EQ, mixer, stereo/bass enhance, NVS profile |
+| Presets | CRUD, reorder, integrated recall + last-preset at boot |
+| Network | SoftAP/STA, tabbed gzipped SPA, typed JSON REST API |
+| Security | `initEncryptedStorage()` — see [`docs/security-flash-nvs.md`](docs/security-flash-nvs.md) |
+| Quality | Doxygen, manual sync, Si4684 blob policy check |
+
+Architecture: **functional core** (`components/core`, host-tested, no ESP-IDF) +
+**imperative shell** (drivers, services, net, secure_store). Rules:
+[`AGENTS.md`](AGENTS.md) · backlog: [`docs/TODO.md`](docs/TODO.md)
+
+## Prerequisites
+
+**Si4684 blobs** (proprietary, local only — not in git):
+
+```bash
+python3 tools/fetch_si4684_firmware.py --dab-only
+python3 tools/fetch_si4684_firmware.py --si46xx-dir /path/to/si46xx_firmware
+python3 tools/check_si4684_blobs.py
+```
+
+See [`Firmware/Si4684-Firmware/README.md`](Firmware/Si4684-Firmware/README.md).
+
+**ESP-IDF** v5.5.x, target `esp32s3`.
 
 ## Quick start
 
@@ -14,11 +42,16 @@ Open this directory (`Software/`) as the Cursor project so `AGENTS.md` and
 ```bash
 idf.py set-target esp32s3
 idf.py build
-idf.py erase-flash flash   # once when upgrading to encrypted NVS (0.8.3+)
-idf.py -p <port> flash monitor
+idf.py erase-flash flash   # once when first enabling encryption (0.8.3+)
+idf.py -p <port> monitor
 ```
 
-Host unit tests (pure core, no hardware):
+Production flash-encryption release mode: overlay `sdkconfig.defaults.production`
+(see security doc — irreversible on chip).
+
+## Host tests
+
+Pure core, no hardware (needs C++23 compiler on macOS — Homebrew `llvm` or GCC 14):
 
 ```bash
 cmake -S components/core/test -B build-host \
@@ -27,7 +60,9 @@ cmake --build build-host
 ctest --test-dir build-host --output-on-failure
 ```
 
-Documentation gates (must exit 0 before merging; also enforced in CI):
+## Quality gates (CI on every push to `main`)
+
+Run from `Software/`:
 
 ```bash
 doxygen Doxyfile
@@ -36,11 +71,15 @@ python3 tools/check_si4684_blobs.py
 python3 tools/gzip-www.sh   # after editing components/net/www/index.html
 ```
 
-Manual PDF (design + HTTP API + class reference):
+CI jobs: `host-tests`, `doxygen`, `manual-sync`, `si4684-blobs`
+(`.github/workflows/ci.yml`).
 
-```bash
-cd docs/manual && latexmk -lualatex manual.tex
-```
+## Web UI
+
+Gzipped single-page app at `/` — tabs: **Now** (RDS/DLS), **Radio**, **Presets**,
+**Audio** (6-band EQ), **BT**, **Wi‑Fi**. Source:
+`components/net/www/index.html` · regenerate embed:
+`tools/gzip-www.sh`.
 
 ## HTTP API (fw 0.8.3)
 
@@ -53,7 +92,7 @@ cd docs/manual && latexmk -lualatex manual.tex
 | POST | `/api/tuner/tune` | Tune DAB ensemble or FM frequency |
 | POST | `/api/tuner/play` | Start DAB service playback |
 | POST | `/api/tuner/seek` | FM seek up |
-| GET/PUT | `/api/audio/profile` | Read/apply ADAU1701 mixer + EQ profile |
+| GET/PUT | `/api/audio/profile` | Read/apply ADAU1701 mixer + 6-band EQ |
 | POST | `/api/audio/reset` | Factory-flat audio profile |
 | POST | `/api/audio/stereo-enhance` | Stereo depth overlay (0–100) |
 | POST | `/api/audio/bass-enhance` | Bass enhance overlay (0–100) |
@@ -67,25 +106,27 @@ cd docs/manual && latexmk -lualatex manual.tex
 | POST | `/api/stations/reorder` | Move preset (`from`/`to` indices) |
 | POST | `/api/stations/tune` | Recall preset (tuner + audio profile + NVS) |
 
-Full schemas, error tokens, and boot flow: [`docs/manual/ch-api.tex`](docs/manual/ch-api.tex).
-C++ signatures: `doxygen Doxyfile` → `docs/api/html/index.html`.
+Wire schemas: [`docs/manual/ch-api.tex`](docs/manual/ch-api.tex) · C++ API:
+`doxygen Doxyfile` → `docs/api/html/index.html`.
 
 ## Layout
 
 | Path | Role |
 |------|------|
-| `Firmware/` | Si4684 `.bin` blobs (DAB+FM) + ADAU1701 SigmaStudio export |
+| `Firmware/` | Si4684 `.bin` (local) + ADAU1701 SigmaStudio export |
 | `components/core/` | Pure domain (host-tested) |
-| `components/drivers/` | Si4684, ADAU1701, BT1035 drivers |
-| `components/services/` | Tuner, audio, Bluetooth, station, integration services |
+| `components/drivers/` | Si4684, ADAU1701, BT1035 |
+| `components/services/` | Tuner, audio, Bluetooth, station, integration |
+| `components/secure_store/` | Encrypted NVS: credentials, profiles, presets |
 | `components/net/` | Wi-Fi, HTTP server, gzipped web UI |
-| `docs/manual/` | LaTeX technical manual (canonical) |
-| `docs/security-flash-nvs.md` | NVS + flash encryption and HIL checklist |
-| `docs/TODO.md` | Agent task list (prioritised backlog) |
+| `sdkconfig.defaults` | C++23, NVS + flash encryption (dev mode) |
+| `partitions.csv` | `nvs` + `nvs_keys` partitions |
+| `docs/manual/` | LaTeX technical manual |
+| `docs/security-flash-nvs.md` | Encryption + device HIL checklist |
+| `docs/TODO.md` | Completed tasks + HIL backlog |
+| `tools/` | Blob fetch, CI policy checks, UI gzip |
 
-See [`AGENTS.md`](AGENTS.md), [`instructions.md`](instructions.md),
-[`docs/security-flash-nvs.md`](docs/security-flash-nvs.md), and
-[`docs/TODO.md`](docs/TODO.md) for coding rules, security, and backlog.
+Manual PDF: `cd docs/manual && latexmk -lualatex manual.tex`
 
 ## Licence