Restructure project documentation

Separate operator guides from development contracts, relocate
implementation notes under `docs/devel/`, and update cross-references
and
hardware tooling paths. Add getting-started, user administration, and
firmware update guides while preserving firmware behavior.

docs/security_operations.md

@@ -2,8 +2,8 @@
 
 This checklist is for a wireless serial cable used occasionally on a trusted network,
 not an Internet-facing appliance or a production-security certification.
-It covers existing firmware operations only: no dependency patches, crypto upgrades,
-secure-boot, encrypted-NVS, or eFuse changes are part of this scope.
+It covers provisioning, daily use, credential changes, and recovery with the existing
+firmware. It does not provide protection against physical extraction or firmware replacement.
 
 ## Provision once, locally
 
@@ -87,14 +87,15 @@ inspect current state on UART0 rather than blindly repeating the operation.
   Treat a lost device or a raw flash copy as potentially exposing stored Wi-Fi secrets,
   private identities, and password verifiers. Rotation is not a secure flash-erasure claim.
 
-## Lightweight maintenance
+## Maintenance precautions
 
-Occasionally, and before a planned firmware update, review relevant ESP-IDF,
-wolfSSL/wolfSSH, and bundled web-library upstream release/security notes.
-If a relevant issue appears, stop network use until a separate upgrade decision is made;
-USB serial remains an option. Dependency upgrades and their validation are separate work,
-not an endless CVE audit or an implied promise that this firmware is vulnerability-free.
+Before installing firmware, review its documented changes and security notices.
+If a relevant security issue is reported, stop network use until an appropriate
+update or mitigation is available; native USB serial remains an option.
+Keep wired UART0 recovery available when updating, and do not assume an update
+preserves configuration unless its migration guidance says so.
 
-Commands and limits were checked against application sources and the [command reference](command_reference.md) at `f40c09c`.
-This is source-reviewed operating guidance, not a build, hardware test, security audit,
-or verification of any individual device's flash/eFuse configuration.
+See the [command reference](command_reference.md) for command details.
+This checklist is operating guidance, not a security audit or verification of any
+individual device's flash/eFuse configuration. Contributor maintenance and evidence
+notes are in the [developer index](devel/README.md#security-maintenance-and-evidence).