docs: fold shipped specs into the architecture docs and delete them

A spec was a promise; sixteen of them had become descriptions of code that
already shipped, sitting beside four that describe work still outstanding, with
nothing in the file telling the two apart. Half the statuses were also wrong —
audio-equalizer read "Accepted" with the EQ live on both platforms, the native
video spec said the flag stays off after the default was flipped on.

The shipped designs move into docs/architecture, which is the maintained
description of the build, and the spec files go. Git history keeps the
originals; what a future change still needs is carried across:

- 01-rust-backend: favourites rewritten (the old section named a file that no
  longer exists and called shipped buttons "planned"), domain vocabulary owned
  by Rust (SearchScope, exclusions, the bitrate ladder), background workers
- 02-svelte-frontend: app shell and chrome, library mosaic, series/episode
  navigation, downloaded browse, safe-area insets, native-video store, logging
- 03-data-flow: locally-indexed search
- 05-platform-backends: audio settings on ExoPlayer, the equalizer's band
  vocabulary, native video compositing, the background-audio handoff
- 06-downloads-and-offline: one storage model, offline catalog visibility
- 09-security: path confinement and input binding

docs/specs/README.md now says what the directory is for and where each shipped
design went. Deferred work the specs recorded is kept beside the code it
concerns rather than lost: season-bounded autoplay, the two dead search
commands, why indexing is a full crawl.

requirements.md had fourteen stale statuses — Android audio parity still read
"Linux only", DR-150 still said the native-video default was off, DR-190 was
Proposed after DR-196 implemented it, and five tooling requirements were
Proposed after landing. Three unbuilt specs suggested requirement ids that have
since been allocated to other work; each now carries a warning.

docs/architecture/09-security.md

@@ -122,6 +122,41 @@ reports `NETWORK_NO_SOURCE` (which is exactly how DR-134's failure presented).
 | Downloaded Media | Filesystem permissions only |
 | Cached Thumbnails | Filesystem permissions only |
 
+## Path Confinement and Input Binding
+
+Two classes of defect, both of the same *shape*: a value that arrived from
+outside decided something it should not, at a site whose neighbours a few lines
+away already did it correctly.
+
+### Filesystem path confinement
+
+| Surface | Rule | TRACES |
+|---------|------|--------|
+| Thumbnail cache | The filename is built from `item_id`, `image_type` and `tag`; all three are sanitised (non-alphanumerics → `_`), and the resolved path is checked with `starts_with(cache_dir)` **at the point of use** | DR-210 |
+| Downloads | `file_path` and `target_dir` are sanitised inside `download_item` itself, not only in `download_item_and_start` — the latter is what made the existing guard bypassable rather than absent | DR-211 |
+
+Two mechanics worth remembering, because both are easy to get subtly wrong:
+
+- `Path::join` **neither folds `..` nor keeps the base when handed an absolute
+  path**. Confinement therefore has to be checked *after* the join, not before.
+- Sanitising is **per path component**. Whole-string sanitising would rewrite
+  `downloads/x.mp3` to `downloads_x.mp3` and relocate every existing download.
+
+The database keeps both the raw key and the resolved path, so lookups still match
+and pre-existing rows still resolve.
+
+### Query and URL construction
+
+Caller-supplied values are **bound or encoded**, never interpolated (DR-212):
+
+- The offline `get_items` item-type filter uses parameter placeholders rather
+  than formatting `IN ('a','b')`.
+- `build_get_items_endpoint` encodes `ParentId` / `IncludeItemTypes` / `SortBy` /
+  `SortOrder`. Encoding is **per element** and list separators stay unencoded,
+  because Jellyfin splits these parameters on the comma.
+- `player_set_volume` clamps at the command boundary — it previously accepted
+  NaN and out-of-range floats even though every backend clamps internally.
+
 ## Security Considerations
 
 1. **No Secrets in SQLite**: The database contains only non-sensitive metadata