Note secret sharing as a tabled tool, with the reasoning attached

Evaluated a Password-Pusher-style service as a Tech Tool and tabled it. The note
carries the decisions rather than just the idea, because those are what cost the
time: it is NOT a Tools-plugin candidate as it stands (that plugin is browser
only by design, with get_blueprint and get_models both empty), the sender must
always be authenticated, a FILE recipient should be logged in too - which costs
nothing on an intranet-only server where anyone who can resolve the link already
has an account - and zero-knowledge encryption is right for a credential but
questionable for a controlled document, where a server that cannot say what was
shared is a liability rather than a feature.

Intranet-only hosting is what makes the idea viable at all: a link mailed
outside is dead and no ciphertext reaches a third party. Pointing staff at the
public hosted instance instead would reinstate every problem this avoids.

docs/ROADMAP.md

@@ -39,6 +39,20 @@ The last big milestone before 1.0 is the legacy-ASP data import plus a productio
 - Pip-installable plugins (deferred per ADR-003 v2). Filesystem distribution stays the v1 model.
 - Event bus on `BasePlugin` (removed per ADR-001; add via new ADR if a real use case appears).
 - Frontend rebuild beyond Vue 3 + Pinia + Vite (the existing stack is fine).
+- Secret and file sharing as a Tech Tool (tabled 2026-08-21). A one-view,
+  expiring link for handing someone a credential, in place of a chat message or
+  a sticky note. NOT a Tools-plugin candidate as it stands: that plugin is
+  browser-only by design (`get_blueprint` and `get_models` are both empty) and
+  this needs storage, expiry and an audit trail, so it would be its own plugin.
+  Decisions already reached, to save rediscovering them: the sender is always
+  authenticated; a FILE recipient should be logged in too, which costs nothing
+  on an intranet-only server where everyone with the link already has an
+  account; separate permissions for sharing a secret and sharing a file, because
+  the risk classes differ; and zero-knowledge encryption is right for a
+  credential but questionable for a controlled document, where "the server
+  cannot say what was in it" is a liability rather than a feature. Export
+  control should confirm internal link sharing in writing before it carries
+  drawings or NC programs.
 
 ## What 1.0.0 means