docs: write the three missing app-developer docs (secrets, quadlet, lifecycle)

The open-source plan flagged three references as "the real gaps for app
developers", and the docs index named them as not-yet-written. Written now,
each from the code rather than stubbed:

- secrets.md — generated_secrets/secret_env: the two halves, the four kinds
  (hex16/hex32/base64/bcrypt) and which files each writes, the idempotent
  self-healing 0600 materialisation, and the rules a developer must not break
  (no hardcoded fallbacks, one canonical name, right encoding). From
  container/secrets.rs and the manifest schema.

- quadlet-compilation.md — manifest -> .container unit: the full directive
  mapping (including Secret= by reference, never value, and Pull=never), where
  units land (~/.config/containers/systemd, systemctl --user), the
  render/write/enable/disable lifecycle with write-if-changed, and how to
  inspect one. From container/quadlet.rs, scoped accurately to the companion-UI
  path it drives today.

- container-lifecycle.md — the level-triggered 30s reconciler: desired state
  from user-stopped/user-uninstalled/manifest set, the operations table, the
  self-heal-vs-respect-a-deliberate-stop rule, and migrations-never-destroy-data.
  From prod_orchestrator.rs and boot_reconciler.rs.

Index updated to link all three under App development and the "known gap" note
removed. Every link across the docs tree resolves.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/README.md

@@ -22,18 +22,15 @@ disagree, the code wins and the doc is a bug.
 
 - [App Developer Guide](app-developer-guide.md) — build and package a containerized app
 - [App Manifest Specification](app-manifest-spec.md) — the manifest schema, field by field
+- [Manifest → Quadlet unit](quadlet-compilation.md) — how a manifest compiles to a systemd-owned container unit
+- [Container lifecycle](container-lifecycle.md) — the reconciler state machine: install/adopt/start/stop/self-heal
+- [App secrets](secrets.md) — declaring, generating and injecting per-install credentials
 - [Registry-Distributed Manifests](registry-manifest-design.md) — how manifests reach nodes via the signed catalog
 - [Decentralized Marketplace Protocol](marketplace-protocol.md) — publishing apps via an external registry
 - [Bitcoin RPC Relay](bitcoin-rpc-relay.md) — letting an external wallet reach the node's Bitcoin RPC
 - [Companion Pairing QR](companion-pairing-qr.md) — the pairing handoff contract
 - [TV input inside iframe apps](tv-input-iframe-apps.md) — keyboard/gamepad routing into embedded apps
 
-> **Known gap (tracked):** three app-developer references named in the
-> open-source plan are not yet written — how a manifest compiles to a
-> Quadlet/systemd unit, the container-lifecycle reconciler state machine, and
-> the `generated_secrets` materialisation flow. Until they land, the source of
-> truth is the code: `core/archipelago/src/container/quadlet*.rs`,
-> `prod_orchestrator.rs`, and `container::secrets` respectively.
 
 ## Design docs