cleanup phases 0 done

docs/roadmap/index.md

@@ -0,0 +1,27 @@
+# Roadmap — where it goes next
+
+> **Populated by phase 5 — not yet written.** Phase 5 depends on phase 4: you cannot sequence work
+> that has not been reconciled into one backlog.
+
+A **proposal**, not a commitment. The ordering is reasoned and can be overruled; what is not negotiable
+is that every item traces to a `BL-###` in [status/backlog.md](../status/index.md), so nothing is
+scheduled that was not first triaged.
+
+## Planned contents
+
+| File | Covers |
+| --- | --- |
+| `next-up.md` | The next 3–5 units of work, each spec'd enough to start |
+| `deferred.md` | Recorded, each with the trigger that pulls it forward |
+| `tech-debt.md` | What must be paid before scale, and what deferring it costs |
+| `pre-launch.md` | The hard gate before real users touch this |
+
+## One item already known for `pre-launch.md`
+
+The repo **contains live credentials on purpose** — a deliberate pre-launch trade for a demo deployment,
+documented in [root CLAUDE.md §6](../../CLAUDE.md) and [DEPLOY.md](../../DEPLOY.md). Before onboarding
+real users those values must be rotated and the secret half moved out of git.
+
+One value is load-bearing and must **never** change: `Seams:FieldEncryption:Key` and `:HashKey` decrypt
+every encrypted column and derive the `PhoneHash` that every login looks up. Rotating them locks every
+account out.