Sync all project docs for firmware 0.8.3 completion.

Update READMEs, manual chapters, agent guides, CONTRIBUTING, and TODO to reflect T1–T8 done, encrypted NVS, CI gates, and pending HIL checklist.

Co-authored-by: Cursor <cursoragent@cursor.com>

Software/.cursor/rules/40-security.mdc

@@ -8,10 +8,10 @@ alwaysApply: false
 
 Full spec: @AGENTS.md §7.5.
 
-- Stores Wi-Fi SSID/password, user credentials, station list. Encrypted
-  at rest (NVS encryption on an encrypted partition, or a device key in
-  eFuse). Confirm the mechanism against current ESP-IDF security docs
-  before implementing.
+- Stores Wi-Fi SSID/password, station list, audio profiles, last-preset index.
+  **Encrypted at rest** — `CONFIG_NVS_ENCRYPTION` + flash encryption in
+  `sdkconfig.defaults` (development mode); `secure_store::initEncryptedStorage()`
+  before any NVS access. See `docs/security-flash-nvs.md`.
 - A `Secret` wrapper: no operator<<, no implicit conversion to a loggable
   string, buffer zeroised on destruction.
 - Secrets are never logged, never placed in URLs, never serialised to