docs: fold todo into roadmap and unify naming

docs/roadmap.md

@@ -1,36 +1,44 @@
 # Roadmap
 
-## v3.1 — Single-file payload (drop the text/file union)
+## Todo
+
+- Localize i18n readmes: `README_ES.md`, `README_zh-CN.md` still reference `REDIS` / `/api/v1`-era endpoint names — align to `CACHE` / `/healthz` (also sweep `CONTRIBUTING.md`, `examples/*`, postman collection).
+- Add remaining shared tooling to the pnpm catalog (`vite`, `tsdown`).
+- Move formatting, linting and type-checking + git hooks onto `vite-plus` (oxlint, oxfmt, vitest).
+- Re-add CSP (`Content-Security-Policy`) wired into the axum router (was in `csp.rs`, removed as unused).
+- Move all CLI deps to `devDependencies` — they bundle into the single output file anyway.
+
+## Unified payload (drop the text/file union)
 
 > Follow-up iteration of the inner payload, parked as `v3.1` (not part of core v3).
 
-Everything becomes a **file**. Text is just a `FileDTO` with `created: true`. The `{ type: "text" } | { type: "files" }` union is removed.
+Everything becomes a **file**. Text is just a `FileDTO` with `inline: true`. The `{ type: "text" } | { type: "files" }` union is removed.
 
 ```
 # Inner layer (encrypted, client-only)
 { files: [
-  { name: string, mime: string, size: number, data: bytes, created?: boolean }
+  { name: string, mime: string, size: number, data: bytes, inline?: boolean }
 ] }
 ```
 
-- `FileDTO` gains `created?: boolean` (default `false`).
-- `created: true` = the file was authored inline at compose time (e.g. an empty text file the user typed into). Purely a **client/UI hint** — rides inside the encrypted inner payload, the server never sees it.
-- `created: true` files render as an **editable text editor**; the rest render as binary file cards (upload/download).
-- Default composer state = one empty `created` text file the user edits. No `isFile` toggle.
+- `FileDTO` gains `inline?: boolean` (default `false`).
+- `inline: true` = the file was authored inline at compose time (e.g. an empty text file the user typed into). Purely a **client/UI hint** — rides inside the encrypted inner payload, the server never sees it.
+- `inline: true` files render as an **editable text editor**; the rest render as binary file cards (upload/download).
+- Default composer state = one empty `inline:true` text file the user edits. No `isFile` toggle.
 
 ### Impact by area
 
 - **Server / wire protocol / `api.ts`**: unchanged. Still an opaque encrypted `data` blob in the outer msgpack envelope.
 - **Shared codec**: `NoteContent` becomes `{ files: FileDTO[] }`; drop the union + `switch(type)` in `unpackContent`. `packContent(input: FileDTO[], password?)`. Breaking inner-msgpack schema → ok, pre-release.
-- **Frontend (`Create.svelte` — biggest)**: one `files: FileDTO[]` model; default empty `created` text file; editor binds a string, encodes to bytes on submit; add real files via upload (`created:false`).
-- **CLI**: `send text "x"` → `files:[{ name:'note.txt', mime:'text/plain', data:utf8, created:true }]`. `send file a b` → drop `type` union. `open`/download prints text files, saves the rest.
+- **Frontend (`Create.svelte` — biggest)**: one `files: FileDTO[]` model; default empty `inline` text file; editor binds a string, encodes to bytes on submit; add real files via upload (`inline:false`).
+- **CLI**: `send text "x"` → `files:[{ name:'note.txt', mime:'text/plain', data:utf8, inline:true }]`. `send file a b` → drop `type` union. `open`/download prints text files, saves the rest.
 - **Tests**: `payload.test.ts` rewritten to `{ files:[...] }`; playwright `switch-file`/`text-field` composer specs collapse + rework.
 
 ### Watches
 
 - text↔bytes round-trip in the editor (encoding, line-endings);
-- `size` must be set from the *encoded* bytes (matches `SIZE_LIMIT` / preview) — recompute after text→bytes;
-- pasted binary files keep `created:false`; only inline-authored text is `created:true`.
+- `size` must be set from the _encoded_ bytes (matches `SIZE_LIMIT` / preview) — recompute after text→bytes;
+- pasted binary files keep `inline:false`; only inline-authored text is `inline:true`.
 
 ### Payload pipeline
 
@@ -64,7 +72,7 @@ flowchart TD
         P --> Q[XChaCha20 decrypt]
         Q --> R[LZ4 decompress]
         R --> S[msgpack decode files]
-        S -->|created:true| T[edit / render text]
-        S -->|created:false| U[save files]
+        S -->|inline:true| T[edit / render text]
+        S -->|inline:false| U[save files]
     end
-```
+```

docs/todo.md

@@ -1,7 +0,0 @@
-# Todo
-
-- also update readmes in other languages
-- use catalog install for common deps (typescript, vite, tsdown, etc. ) please suggest.
-- move formatting, linting, type checking and git hooks to vite-plus (uses oxlint, oxfmt, vitest and git hook dispatcher)
-- re-add CSP (Content-Security-Policy) into axum router ( (was in csp.rs, removed as unused)
-- move all deps to devDeps for the cli, as they are all bundled into one file.