[kosisochukwu1234]

Summary

Adds apps/web/docs/contracts-client-data-at-rest.md, an inventory of every place the web client stores data at rest across in-memory caches, localStorage, sessionStorage, IndexedDB, and the service worker cache.

Coverage

• Master Inventory Table: Maps every storage location, key/store name, stored contents, sensitivity classification (private key / plaintext / metadata / non-sensitive), and source module.
  • Device ID and identity public key in localStorage (src/lib/deviceIdentity.ts)
  • Trusted identity snapshots in localStorage (src/lib/identityTrust.ts)
  • Plaintext message cache cleared on unload (src/lib/crypto/plaintextCache.ts)
  • Local search index in IndexedDB clicked-search and worker memory (src/lib/search/db.ts, src/lib/search/searchWorker.ts)
  • Session and prekey stores in memory and IndexedDB (clicked_prekeys, clicked_sessions, driptide-crypto, signalSession.ts)
  • Auth token storage across keys (clicked.jwt, clicked_token, auth_token)
  • Service worker cache (documents that public/sw.js maintains no cache storage)
• Lifecycle & Teardown Analysis: Documents what logout (signOut), device revocation (/devices/:id, /devices/logout-everywhere), and page unload clear.
• Known Gaps: Details all data categories that survive logout and revocation (including unpurged decrypted search index, IndexedDB key material, trust pins, and device IDs).
• Security Flag: Explicitly flags process.env.NEXT_PUBLIC_AUTH_TOKEN in src/lib/auth.tsx as a development fallback that must never be set in production builds.

Closes #628