Release Crypto Tools 0.1.0

public/docs/ACCESSIBILITY.md

@@ -0,0 +1,3 @@
+# Accessibility
+
+The workbench uses semantic landmarks, headings and labelled native controls, supports keyboard operation, visible focus, reduced-width layouts, and system/light/dark themes through the Toolbox shell. Results do not rely on colour alone.

public/docs/ARCHITECTURE.md

@@ -0,0 +1,7 @@
+# Architecture
+
+Crypto Tools is a static React/Vite inspection application wrapped in the shared Toolbox shell. `crypto/inspection.ts` accepts a bounded string or byte buffer, separates PEM blocks or JSON, and produces one plain report model. It uses `@peculiar/x509` for X.509/PKCS #10/CRL parsing and signature primitives, and browser WebCrypto for SHA-256 fingerprints and RFC 7638 thumbprints.
+
+Certificate linking is deliberately explicit and shallow: certificates in the same input are matched by issuer/subject and the child signature is checked with that candidate. The app does not build a trust path, load platform roots, fetch intermediates or revocation data, or infer trust from a valid signature. DNS SAN matching is an isolated syntax check against a user-entered host name.
+
+The 8 MiB/256-PEM-block bounds are checked before expensive parsing. Version 0.1 does not use a worker, persistence, or a server API. Relative entry and asset URLs keep the build relocatable below a nested portal path.

public/docs/PRIVACY-SECURITY.md

@@ -0,0 +1,7 @@
+# Privacy and security
+
+Certificate, key and JWK material is parsed locally and kept only in page memory. The app makes no network request, does not consult a trust store, and has no telemetry, analytics, account or persistence. File input is size-checked before it is read; text/DER input is limited to 8 MiB, PEM input to 256 blocks, and JWKS input to 1,000 valid JWK objects.
+
+Private or symmetric material is identified and prominently warned about, but never decrypted, generated, exported or stored by the app. A compromised browser, extension, device or copied report can still expose sensitive material, so users should prefer public test material whenever possible.
+
+Fingerprints and thumbprints identify exact bytes or canonical JWK members; they do not establish identity or trust. Issuer signature links are not RFC 5280 validation, validity dates use the local clock, and no live revocation check is performed. Rendered values are React text rather than imported HTML.