Reorganise docs: move historical files to archive/, merge overlapping docs

- Move 12 historical/superseded docs + 1 session log + 1 PDF + 1 HTML plan to archive/
- Merge 4 VM-crash docs into archive/vm-crash-incident.md
- Merge LDAP plan + spec into ldap.md
- Merge FilePond race investigation into filepond-crash-analysis.md
- Merge SPECS.md client notes into spec-sheet.md appendix
- Update README index and security.md cross-reference

docs/README.md

@@ -1,7 +1,7 @@
 # Documentation index
 
-This directory mixes **current reference** docs, **proposals/plans**, and
-**historical/archived** analysis. Use this index to find the right document.
+This directory separates **current reference** docs, **proposals/plans**, and
+**historical/archived** analysis (in [`archive/`](archive/)).
 
 > **Note on naming:** XAMXAM was previously *Post-ERG* (and the code was once
 > organised under `posterg-website/`, `apps/`, `front-backend/`,
@@ -31,7 +31,7 @@ This directory mixes **current reference** docs, **proposals/plans**, and
 
 | Doc | Status |
 |-----|--------|
-| [LDAP_AUTH_PLAN.md](LDAP_AUTH_PLAN.md) + [LDAP_SPEC.md](LDAP_SPEC.md) | LDAP login — **not implemented** |
+| [ldap.md](ldap.md) | LDAP login — **not implemented** (merged plan + spec) |
 | [monolog-plan.md](monolog-plan.md) | Single Monolog logger replacing AppLogger/AdminLogger/ErrorHandler/Audit — **plan** |
 | [de-librairisation.md](de-librairisation.md) | Replace bespoke SMTP/Markdown/HTTP/crypto with libraries (partly done) |
 | [refactoring.md](refactoring.md) | Older refactoring proposal |
@@ -39,31 +39,36 @@ This directory mixes **current reference** docs, **proposals/plans**, and
 | [ANALYSIS_INLINE_JS_CSS_MINIFY.md](ANALYSIS_INLINE_JS_CSS_MINIFY.md) | Inline JS/CSS/minify analysis (largely actioned by the build system) |
 | [backup-plan.md](backup-plan.md) | Backup plan — largely implemented (see deployment.md) |
 | [repertoire-mobile-propositions.md](repertoire-mobile-propositions.md) | Mobile repertoire UI proposals |
-| [cms-migration-plan.html](cms-migration-plan.html) | CMS migration plan |
-| [spec-sheet.md](spec-sheet.md) | Original requirements fiche technique |
-| `Proposition procédure licences_V2.pdf` | Licence procedure proposal (filename contains non-ASCII/combining chars) |
+| [spec-sheet.md](spec-sheet.md) | Original requirements fiche technique (incl. client notes appendix) |
 
-## Historical / archived (kept for context — may reference the old codebase)
+## Active investigations (unresolved)
+
+| Doc | Status |
+|-----|--------|
+| [filepond-crash-analysis.md](filepond-crash-analysis.md) | FilePond upload crash — **unresolved**, root cause in vendor code (merged race-investigation appendix) |
+| [peertube-sso-incident.md](peertube-sso-incident.md) | PeerTube `invalid_grant` diagnosis & ownership |
+| [autosave-system.md](autosave-system.md) | Autosave architecture & HTMX migration assessment |
+
+## Historical / archived (in [`archive/`](archive/))
+
+Kept for context — may reference the old codebase. Not maintained.
 
 | Doc | Contents |
 |-----|----------|
-| [LIVRAISONS_PAR_MOIS.md](LIVRAISONS_PAR_MOIS.md) | Monthly delivery log grouped by functional family |
-| [migration-history.md](migration-history.md) | History of major structural migrations |
-| [CURRENT_ISSUES.md](CURRENT_ISSUES.md) | Issue log (2026-05-10) — many since resolved |
-| [IMMEDIATE_FIX.md](IMMEDIATE_FIX.md) | One-off fix note |
-| [EVIDENCE_SUMMARY.md](EVIDENCE_SUMMARY.md) + [VM_Crash_*.md](VM_Crash_Analysis_FINAL.md) | VM crash investigation (concluded: not the app) |
-| [css.md](css.md) | Old Bulma-removal writeup (pre-dates current build system; see CSS.md) |
-| [php-vs-flask.md](php-vs-flask.md) | Language choice decision |
-| [orm-assessment.md](orm-assessment.md) | ORM evaluation |
-| [system-setup.md](system-setup.md) | Old setup notes |
-| [SETUP.md](SETUP.md), [SPECS.md](SPECS.md), [TODO.md](TODO.md) | Earlier setup/spec/todo snapshots |
-| [SMTP_550_POSTFIX_FIX.md](SMTP_550_POSTFIX_FIX.md) | SMTP troubleshooting record |
-| [testing.md](testing.md) | PHP testing best-practices writeup |
-| [test-plan.md](test-plan.md) | Manual test plan |
-| [autosave-system.md](autosave-system.md), [filepond-crash-analysis.md](filepond-crash-analysis.md), [filepond-race-investigation.md](filepond-race-investigation.md) | Feature/issue deep-dives (status noted in each file) |
-| [pi-session-2026-05-10T*.html](pi-session-2026-05-10T18-42-37-234Z_019e1332-ce31-70fa-87a1-aa3495b526a9.html) | Captured session log |
-| [ANALYSIS_INLINE_JS_CSS_MINIFY.md](ANALYSIS_INLINE_JS_CSS_MINIFY.md) | *(see proposals)* |
-| [bookmarklet.md](bookmarklet.md) | *(kept current — see above)* |
+| `vm-crash-incident.md` | VM crash root-cause (merged final report + reports + evidence + fix) |
+| `CURRENT_ISSUES.md` | Issue log (2026-05-10) — many since resolved |
+| `LIVRAISONS_PAR_MOIS.md` | Monthly delivery log grouped by functional family |
+| `migration-history.md` | History of major structural migrations |
+| `php-vs-flask.md` | Language choice decision |
+| `orm-assessment.md` | ORM evaluation |
+| `css.md` | Old Bulma-removal writeup (see CSS.md for current) |
+| `system-setup.md` | PHP-extension inventory |
+| `SETUP.md` | Earlier setup snapshot (see development.md) |
+| `testing.md` | PHP testing best-practices writeup |
+| `SMTP_550_POSTFIX_FIX.md` | SMTP troubleshooting record |
+| `cms-migration-plan.html` | CMS migration plan |
+| `Proposition procédure licences_V2.pdf` | Licence procedure proposal |
+| `pi-session-2026-05-10T*.html` | Captured session log |
 
 ## Related documentation elsewhere
 
@@ -74,5 +79,5 @@ This directory mixes **current reference** docs, **proposals/plans**, and
 ---
 
 **Maintenance guidance:** when updating code, update the matching *current
-reference* doc in the table above. Leave *historical* docs untouched (they are
-read-only context). Move newly-written analysis into the appropriate section.
+reference* doc in the table above. Leave *archived* docs untouched (read-only
+context). Move newly-written analysis into the appropriate section.