chore(scaffold): initial SilverMetal program scaffold

Cross-platform privacy-hardening program. Two-layer product:
- SilverLABS Application Stack (cross-platform spine)
- Platform Hardening Profiles (per-OS, tier-honest)

Platforms: Linux (Debian/Kicksecure), Android (Pixel/Samsung/Moto/generic),
Windows (LTSC IoT), macOS (profile), iOS (MDM profile). Each flavour has
both a preflashed hardware SKU path and a self-apply "harden your existing
device" path.

Includes umbrella docs (README + threat-model, design-principles,
platform-matrix, roadmap, trust-model), per-platform and per-stack-
component README stubs, .gitignore, LICENSE.

Linux v1 ships first; Stack v1 = Browser + VPN + Sync.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

stack/keys/README.md

@@ -0,0 +1,41 @@
+# SilverKeys
+
+**Status**: v1.1 (planning)
+
+Zero-knowledge password + 2FA + key manager. Synced via SilverSync.
+
+## Approach (tentative — to be finalised)
+
+Most likely **fork Bitwarden** (server + clients are open source, mature, well-audited) and:
+- Replace the account model with our SilverLABS account number
+- Replace the server with one running on SilverSync infrastructure
+- Strip telemetry / phone-home in clients
+- Re-skin to SilverMetal branding
+
+Alternative: lightweight KeePassXC-derived client with our own sync layer. Simpler but less feature-rich.
+
+## Non-negotiables
+
+- Zero-knowledge: server cannot read vault content
+- Argon2id KDF for master password
+- Multi-device sync via SilverSync
+- TOTP / WebAuthn / hardware-key (YubiKey) support
+- Open source clients
+- No telemetry
+
+## Per-platform clients
+
+- **Linux**: native (Tauri / Rust) or web-app
+- **Android**: Bitwarden-fork rebranded
+- **Windows**: Bitwarden-fork rebranded
+- **macOS**: Bitwarden-fork rebranded
+- **iOS**: Bitwarden-fork rebranded
+- **Browser extension**: SilverBrowser-bundled by default; available for non-SilverBrowser too
+
+## Migration
+
+Bitwarden vault import works out-of-the-box with the fork. Documented procedures for migration from:
+- 1Password
+- LastPass
+- Chrome / Safari / Firefox saved passwords
+- KeePassXC