docs: rename yt-offline → Catacomb across README, ROADMAP, guides, packaging

Prose + commands updated to the new name: brand reads "Catacomb", while
binary/path/package references are the lowercase `catacomb` (commands, deb/rpm
names, ~/.local/share/catacomb, catacomb.db, catacomb.desktop). Codeberg repo
URLs left pointing at the existing repo. Also folds in the pending doc edits
from earlier in the session.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

AGENTS.md

@@ -4,7 +4,7 @@ This file provides guidance to Codex (Codex.ai/code) when working with code in t
 
 ## What this is
 
-`yt-offline` — a single Rust binary that is **both** a desktop GUI (eframe/egui)
+`catacomb` — a single Rust binary that is **both** a desktop GUI (eframe/egui)
 and a headless web server (axum), wrapping `yt-dlp` to archive YouTube/TikTok/
 Twitch/etc. AGPL-3.0. North-star goal and feature-parity tracking live in
 [ROADMAP.md](ROADMAP.md); a structured analysis of the Tartube benchmark is in
@@ -17,8 +17,8 @@ cargo build --release           # the binary (release profile is opt-level=3 + t
 cargo test --release            # unit tests + tests/api.rs integration tests (no network)
 cargo test --release <name>     # single test by substring, e.g. `cargo test --release subs_disabled`
 cargo test --release real_ffmpeg -- --ignored   # opt-in: real-ffmpeg fingerprint accuracy/speed check
-./target/release/yt-offline           # desktop GUI mode (default)
-./target/release/yt-offline --web 8080  # headless web server on a port
+./target/release/catacomb           # desktop GUI mode (default)
+./target/release/catacomb --web 8080  # headless web server on a port
 
 scripts/package.sh [deb|rpm|appimage|all]   # build distro packages → dist/ (see docs/PACKAGING.md)
 ```
@@ -103,6 +103,12 @@ in memory and mutating endpoints mirror DB writes onto those caches +
 `bump_library_version()` (the ETag) so `/api/library` stays consistent without a
 rescan.
 
+Web login sessions are runtime-owned but restart-persistent: `web.rs` keeps the
+live `HashMap<String, u64>` and mirrors tokens into the `sessions` table, then
+rehydrates non-expired rows at startup. Logout and password changes clear those
+rows. The DB is plain SQLite, not encrypted, so `/api/backup/db` exports a
+sensitive file; at-rest DB encryption is deliberately deferred to Phase 4.
+
 Three `(path|video_id, mtime)`-keyed caches let expensive work happen once and be
 skipped on unchanged files: `info_cache` (parsed `info.json` fields),
 `search_meta` + the `video_search` FTS5 index (full-text title/channel/
@@ -123,7 +129,7 @@ whole SPA — a `cargo build` won't catch it since the HTML is just a string).
 ### Bundled toolchain & anti-bot
 
 `ytdlp_bin.rs` manages an optional self-contained venv at
-`~/.local/share/yt-offline/` (nightly `yt-dlp[default]` via `--pre` + `curl_cffi`
+`~/.local/share/catacomb/` (nightly `yt-dlp[default]` via `--pre` + `curl_cffi`
 for TLS impersonation + bundled `deno`). `pot_provider.rs` runs `bgutil-pot` (a
 loopback HTTP server) for YouTube Proof-of-Origin tokens; **its yt-dlp plugin
 must come from the same release as the server binary, not PyPI** (version skew
@@ -154,14 +160,17 @@ both the transcript indexer and the transcript viewers.
 ## Conventions
 
 - **Never commit** `cookies.txt` (live session creds), `config.toml` (user-
-  specific), or `yt-offline.db` (contains the Argon2 password hash). All
-  gitignored.
+  specific), or `catacomb.db` (plain SQLite app state, including the Argon2
+  password hash and restart-persistent session tokens). All gitignored.
 - Redact the absolute cookies path out of any log line surfaced to the UI/API
   (`redact_sensitive` in `downloader.rs`) — it leaks `$HOME`.
 - `app.rs` and `web.rs` are large (~3–4k lines) because each owns a full UI; new
   desktop code goes in `app.rs`, web handlers in `web.rs`, shared logic in the
   focused modules (`downloader`, `database`, `library`, `platform`, `fingerprint`,
   `vtt`, …).
-- Tray (`ksni`) and file dialogs (`rfd` xdg-portal) are Linux-only/no-GTK by
-  design; keep that posture (it's why packaging avoids a GTK dep). Windows/macOS
-  are not yet first-class — the tray would need a per-OS backend.
+- Tray (`ksni`) and the `rfd` xdg-portal dialog backend are Linux-only/no-GTK
+  by design (it's why packaging avoids a GTK dep). They're target-gated in
+  `Cargo.toml`; off Linux, `rfd` uses its native backend and `tray::start` is a
+  no-op. Windows now ships as a cross-compiled zip; macOS has a local osxcross
+  packaging path but is not in CI and still needs signing/notarization + a real
+  tray backend.