Snapshot in-progress work: Ariadne mobile, Theseus password manager, Hephaestus

Several concurrent workstreams committed together as a checkpoint:

- Ariadne mobile resolver — BchFetcher/Bns/MainActivity resolution logic,
  AndroidManifest + build.ps1
- Theseus password manager — settings.html/chrome.html/settings-preload.js UI +
  main.js wiring + package.json resource; Argus password-vault.js, record-picker.js
  (+ tests) and resolver-web.d.ts
- Hephaestus — new BCH-wallet OIDC auth-proxy + Forgejo docker-compose and
  restic/S3 scripts (secrets referenced via env only; Hephaestus/.env is gitignored)
- Argus public-gateway.mjs updates
- Docs — root README, Email README/RUNBOOK, VPS access runbooks (Checkers/Deviant),
  site/hermes, WebsiteDev registry + faster-blocks, Failures/ AAAA-mangle writeup,
  Decentralized Storage map, coordination notes
- .gitignore — exclude /.keys/ and Hephaestus/.env

hermes/index.html

@@ -82,6 +82,34 @@
   </div>
 </section>
 
+<section>
+  <h2>Where your history lives</h2>
+  <p class="lede">Three modes, one toggle. The default assumes no cloud at all — every
+    later option is opt-in, and none of them let anyone but you read your messages.</p>
+  <div class="grid">
+    <div class="card">
+      <h3>Local only <span class="src s-chain">default</span></h3>
+      <p>The client keeps your message history on the device. Nothing else knows it
+         exists. Same seed on Theseus and Ariadne gives you two-device redundancy for
+         free — lose one, restore from the other. Lose both, history is gone. Signal's
+         model, on purpose.</p>
+    </div>
+    <div class="card">
+      <h3>Silent Mode cloud backup <span class="src s-chain">opt-in</span></h3>
+      <p>Toggle on and the client encrypts your message history with a key derived
+         from your wallet seed, then backs it up to decentralized cloud storage on
+         the Sia network. Only you can read it. <b>Text messages only</b> — no
+         pictures, no video, no attachments.</p>
+    </div>
+    <div class="card">
+      <h3>Your own Sia account <span class="src s-chain">advanced</span></h3>
+      <p>Prefer to own the storage yourself? Hermes sets up your own Sia account
+         and routes your backups there instead. Same encryption from your wallet
+         seed — and this time media backup is on the table too.</p>
+    </div>
+  </div>
+</section>
+
 <section>
   <h2>Honest boundaries</h2>
   <div class="grid">