Move docs/ package mirror into document-navigator plugin

Relocate the ~6k-file docs tree from the repo root into
plugins/document-navigator/docs/ so the plugin is self-contained and
portable. docs/superpowers/ (specs and plans) stays at the repo root.

Moved via cp+rm rather than git mv because directory rename() fails with
EPERM on this WSL /mnt DrvFs mount; git rename-detection pairs the
identical-content files at commit time.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/document-navigator/docs/security-stack/security/hibp/src/client/client.md

@@ -0,0 +1,97 @@
+# `client/client.ts`
+
+<!-- begin:auto-docs -->
+_(no submodules)_
+<!-- end:auto-docs --> - options.schema — `HibpClientOptionsSchema` is the Z…
+- [options.schema](./options.schema.md) — `HibpClientOptionsSchema` is the Zod boundary for the `HibpClient` constructor. It is `.strict()` — unknown keys cause…
+- options.schema — `HibpClientOptionsSchema` is the Z…
+
+- [options.schema](./options.schema.md) — `HibpClientOptionsSchema` is the Zod boundary for the `HibpClient` constructor. It is `.strict()` — unknown keys cause…
+
+- options.schema — `HibpClientOptionsSchema` is the Z…
+
+- [options.schema](./options.schema.md) — `HibpClientOptionsSchema` is the Zod boundary for the `HibpClient` constructor. It is `.strict()` — unknown keys cause…
+
+- options.schema — `HibpClientOptionsSchema` is the Z…
+
+- [options.schema](./options.schema.md) — `HibpClientOptionsSchema` is the Zod boundary for the `HibpClient` constructor. It is `.strict()` — unknown keys cause…
+- [options.schema](./options.schema.md) — `HibpClientOptionsSchema` is the Zod boundary for the `HibpClient` constructor. It is `.strict()` — unknown keys cause…
+
+## Purpose
+
+`HibpClient` is the public façade composing the range client, the
+breach client, the cache, the rate-limit gate, and the observability
+surface into one constructor. It is the entry point downstream code
+imports — `import { HibpClient } from "@suaveplan/hibp"` — and the
+target of every option flag declared in the
+[options schema](./options.schema.md). Stateless beyond its cache.
+
+## Features
+
+- Single constructor accepts every documented option: `apiKey`,
+  `strict`, `differentialPrivacy`, `assertOutgoingRequestSafe`,
+  `fetch`, `clock`, `rng`, `logger`, `cache`, `ntlmHash`,
+  `maxAttempts`.
+- Options validated through `HibpClientOptionsSchema` (strict — unknown
+  keys rejected) at construction time.
+- `cache: null` opts out (resolves to `NullHibpCache`); omitting the
+  field uses `LruHibpCache` defaults; passing a custom adapter accepts
+  any `HibpCacheLike` implementation.
+- Authenticated methods (`getBreachesForAccount`, `getBreach`,
+  `getAllBreaches`, `getPastesForAccount`) require `apiKey`; calling
+  them without one throws synchronously with a descriptive error.
+- Range-API method (`checkPassword`) is always available; results are
+  cached by 5-hex prefix.
+
+## Usage: Basic Example
+
+```ts
+import { HibpClient } from "@suaveplan/hibp";
+
+const client = new HibpClient();
+const { pwned } = await client.checkPassword("hunter2");
+```
+
+## Usage: Advanced Example
+
+```ts
+import { HibpClient } from "@suaveplan/hibp";
+
+const client = new HibpClient({
+    apiKey: process.env.HIBP_API_KEY!,
+    strict: true,
+    differentialPrivacy: { extraPrefixes: 3 },
+    rng: myInjectableRng,
+    assertOutgoingRequestSafe: true,
+    cache: null,
+    maxAttempts: 5,
+});
+
+const breaches = await client.getBreachesForAccount("user@example.com");
+```
+
+## API Reference
+
+- `DifferentialPrivacyOptions` — `{ extraPrefixes: number }`.
+- `HibpClientOptions` — every documented constructor flag.
+- `CallOptions` / `BreachOptions` — `{ signal? }` and
+  `{ signal?, domain? }`.
+- `new HibpClient(options?)`.
+- `checkPassword(password, { signal?, mode? }?): Promise<PwnedResult>`.
+- `getBreachesForAccount(email, opts?): Promise<Breach[]>`.
+- `getBreach(name, opts?): Promise<Breach>`.
+- `getAllBreaches(opts?): Promise<Breach[]>`.
+- `getPastesForAccount(email, opts?): Promise<Paste[]>`.
+
+## Implementation Notes
+
+The façade keeps the public surface narrow on purpose: the four
+authenticated methods forward straight to `BreachClient`, the
+range-API call routes through the cache before delegating to
+`RangeClient`. Cache keys use the SHA-1 5-hex prefix even when the
+caller asks for NTLM mode unless an NTLM adapter is supplied, in which
+case the NTLM 5-hex prefix is the key. This split keeps the default
+case fast while preserving correctness when the caller configures
+NTLM. The constructor uses plain mutable record builders instead of
+typed-readonly objects so `exactOptionalPropertyTypes: true` does not
+reject conditional property assignment.

plugins/document-navigator/docs/security-stack/security/hibp/src/client/options.schema.md

@@ -0,0 +1,60 @@
+# `client/options.schema.ts`
+
+## Purpose
+
+`HibpClientOptionsSchema` is the Zod boundary for the `HibpClient`
+constructor. It is `.strict()` — unknown keys cause a synchronous throw
+at construction time. This catches typos like `Cache: null` (capital C)
+that would otherwise silently fall through to the default cache, and
+keeps the public option surface honest: every flag is documented, and
+every new flag forces an explicit schema update.
+
+## Features
+
+- Strict object — every unknown key throws.
+- `apiKey` constrained to `string` of minimum length 1 (an empty key
+  would silently produce unauthenticated calls).
+- `differentialPrivacy.extraPrefixes` validated as a non-negative
+  integer.
+- `maxAttempts` validated as a positive integer.
+- Runtime callbacks (`fetch`, `clock`, `rng`, `logger`, `cache`,
+  `ntlmHash`) typed as `z.unknown()` because Zod cannot introspect
+  arbitrary function shapes; structural validation happens at usage
+  time inside the relevant sub-client.
+
+## Usage: Basic Example
+
+```ts
+import { HibpClientOptionsSchema } from "@suaveplan/hibp";
+
+HibpClientOptionsSchema.parse({ apiKey: "k_test", strict: true });
+```
+
+## Usage: Advanced Example
+
+```ts
+import { HibpClientOptionsSchema } from "@suaveplan/hibp";
+
+function validateConfig(raw: unknown): void {
+    const parsed = HibpClientOptionsSchema.parse(raw);
+    if (parsed.differentialPrivacy && parsed.differentialPrivacy.extraPrefixes > 5) {
+        throw new Error("decoy count > 5 is operationally expensive");
+    }
+}
+```
+
+## API Reference
+
+- `HibpClientOptionsSchema: ZodObject` — strict.
+- `HibpClientOptionsInput` — `z.infer<typeof HibpClientOptionsSchema>`.
+
+## Implementation Notes
+
+The schema validates the *shape* of options rather than their runtime
+identity — the `fetch` field is allowed to be any value because the
+real `fetch` is a function and Zod has no way to distinguish a fake one
+from a real one. Runtime errors from passing a non-function fetch will
+surface at call time as a typed `HIBP.NETWORK_ERROR` with a helpful
+cause chain. The boundary is invoked exactly once per `HibpClient`
+construction so its cost is amortised over the lifetime of the
+instance.