feat: release authentication diagnostics 0.2.0

src/components/HelpDialog.tsx

@@ -35,21 +35,24 @@ export function HelpDialog({
         <p>
           OTP seeds are equivalent to a second-factor credential. This app keeps
           them in memory only, masks them by default and clears them on reload.
-          Exports are explicit and unencrypted; move them only through a secure
-          channel.
+          Plain URI/CSV exports are explicit and unencrypted. The encrypted
+          backup option authenticates its contents with AES-GCM and a password;
+          it is still not a recovery service or persistent browser vault.
         </p>
         <h3>OTP clock and counters</h3>
         <p>
           TOTP is computed from this device’s clock. A rejected valid-looking
-          value commonly means clock drift, a different period, or the wrong
-          hash/digit profile. HOTP counters must remain synchronized.
+          value commonly means clock drift, a different T0/period, or the wrong
+          hash/digit profile. The timeline and drift finder are diagnostics;
+          HOTP counters must remain synchronized.
         </p>
         <h3>Passkey inspection</h3>
         <p>
           Inspection is offline. Verification is layered: client-data
           expectations, RP ID hash, authenticator flags, counter and
-          cryptographic signature are reported separately. Metadata is never
-          fetched silently.
+          cryptographic signature are reported separately. Attestation signature
+          validity, metadata status and trust are distinct results. Metadata is
+          imported explicitly and never fetched silently.
         </p>
         <h3>Live ceremonies</h3>
         <p>