docs(wallet): connect backup, portability and recovery guidance

[ty-everett]

A wallet can recover its root key and still lose the records needed to use its outputs. This documentation-only change makes that requirement prominent in the Wallet Toolbox README and connects a complete recovery learning path across TS Stack.

Program and scope

• Responds to wallet-builder feedback about missing backup/recovery guidance and the distinction between BRC-38/39 data portability and complete disaster recovery.
• Four new guides cover the recovery inventory and ownership, source-verified BRC-38/39 integration, a clean-device/provider-loss drill with an evidence template, and a copyable implementation brief for AI agents.
• Connects the guides from root/package READMEs, docs landing pages, BRC-100 architecture, BRC index, browser/mobile, examples, WAB Shamir and Wallet Infra guidance.
• The protection comparison names the responsible user/custodian or storage operator and links to the detailed responsibility table. The backup example distinguishes key custody from operator database backups.
• Corrects stale example links, private examples-workspace installation advice, the old SQLite candidate wording, and a documentation sample that printed the root key.
• Base: current main at 40dad06ddc96760470daf7fb20e856b44431c71e. Exact reviewed head: 279bf08920ad913c68f092a8135adae14fcab1fd.
• Runtime implementation, schemas, cryptography, manifests, dependencies, generated artifacts, contribution policy, deployments and publication are outside this documentation-only change. Pending Wallet interoperability and reliability: bounded sync, proof recovery and BRC-118 payments #569 APIs are not presented as available.

Impact

• No public package executable source or manifest changed
• Documentation or examples changed (Markdown code examples only)
• All 23 changed files are Markdown. The guides distinguish root keys, key-manager snapshots, wallet records, product-specific state and backup access. They document concrete-provider requirements, profile/network binding, restore vs merge, consistency/resource limits, active-storage authority and realistic acceptance evidence.
• Public desktop/browser/Peacock integration references are labelled by reviewed PR status, not claimed as released or universally compatible.

Verification

Official Node 24.18.0 / pnpm 10.33.2:

• Frozen install with dependency lifecycle scripts disabled; only the existing allowlisted esbuild and better-sqlite3 rebuilds used.
• pnpm health:check, pnpm lint, pnpm format:check, pnpm build, pnpm typecheck: pass. Health reports zero contract findings/control errors; the existing expired Sonar exception is a maintenance warning, unchanged by this PR.
• pnpm audit:security: no known vulnerabilities.
• pnpm --filter docs-site validate: 128 source pages pass frontmatter/link validation.
• pnpm docs:build: 133 HTML pages pass built-link validation.
• Prior implementation validation (the wallet portable source and examples are unchanged by this follow-up): both new TypeScript API snippets compile with strict checking against current public declarations.
• pnpm --filter @bsv/wallet-toolbox exec jest --runInBand --watchman=false --runTestsByPath test/storage/portable.test.ts: 11 existing tests pass, covering canonical export, restore, merge/remapping, encrypted round-trip and rejection cases.
• 36 source/recovery-page link targets checked; git diff --check passes; Markdown-only scope verified.
• The new drill is an acceptance plan, not a claim that its device, cross-wallet or production recovery scenarios were run in this documentation PR. No runtime behavior, coverage requirement or test threshold changes.
• Complete diff self-reviewed for correctness, security, compatibility, artifacts, dependencies, documentation and operations
• Updated-head hosted checks are still in progress. The maintainer explicitly authorized an administrative merge of this documentation-only PR without waiting for CI; pending checks are not represented as passed.

Security and dependencies

• No dependency or lockfile change
• No new override, advisory dismissal, quality suppression or skipped test
• Workflow permissions and lifecycle-script policy unchanged
• No new runtime trust boundary. Guidance requires independent key recovery, protected backups, file/KDF resource admission, validated profile/network selection, isolated targets and explicit cutover. Public examples contain no real recovery material or operator data.
• Updated-head CodeQL and repository Sonar findings gates pending.

Dependency evidence

Not applicable: no dependency, lockfile, export, type, wire, schema or runtime change. No performance or bundle-size claim is made.

Release and operations

• No npm/image publication or release tag performed; merge uses the existing documentation-site deployment workflow.
• No consumer API or data migration required
• Per the requested documentation-only scope, package versions/release metadata are deliberately unchanged. README/package-doc text included in a future npm artifact must receive fresh affected-package versions and release notes through the normal reviewed release process; this PR does not republish existing tarballs. GitHub/source and the docs site receive the guidance on merge; already-published npm README bytes do not change retroactively.
• Documentation site uses the existing repository deployment path. No hosting or infrastructure configuration changes.

Completion evidence

• Documentation and operational guidance updated within scope
• Final diff reviewed at the exact head; zero review conversations. Hosted CI remains in progress under the explicit maintainer merge override.
• Updated-head hosted verification remains pending and is not claimed complete.
• Maintainer requested immediate administrative merge after the documentation review, explicitly waiving the wait for hosted CI. Auto-merge is not enabled.

Hosted runs for the updated head (pending at the authorized merge): CI, CodeQL, Conformance, runtime contracts.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Reviewed the complete documentation-only diff at 279bf08920ad913c68f092a8135adae14fcab1fd, including the follow-up ownership column, linked responsibilities and clarified custody example. No actionable findings; 23 Markdown files, no executable source, manifest, dependency or runtime changes. Local health, lint, formatting, build, typecheck, documentation validation/build and security audit pass.

The maintainer explicitly requested immediate administrative merge without waiting for hosted CI. Updated-head checks remain in progress and are not claimed successful. This is the author/maintainer review record, not an independent approval. The existing docs-site workflow runs on merge; npm/image publication is outside scope.