S25: HSM custody, sync.pfc, georgelambert.org/pfc deep links

UserReview leftovers implemented without rewriting 70 website repos
and without fail-closing pfc-py-admin.

docs/HSM-CUSTODY.md

@@ -0,0 +1,44 @@
+# HSM / key custody
+
+This is **not** a HIPAA/SOC 2/ISO certificate.
+
+## What lives where
+
+| Key | Lab (ns1) | Production |
+|---|---|---|
+| Config Ed25519 | `/opt/pfc/etc/sm-keys/config.ed25519.pem` mode 0600 root | Customer HSM / PKCS#11; public half in signed wrapper `sig.key_id` |
+| NPE HPKE | `/opt/pfc/etc/npe/lab.seed` + `lab.npeid` (host only) | `npe keygen --rotate --id` on HSM-backed seed; inbox id unchanged |
+| System bounce | `crypto.system_key_id` in signed payload | Same id; private material in HSM |
+| Session / Google | `/opt/pfc/etc/admin.env` | Secrets manager; never git |
+
+Private files are **never** committed. Public PEMs and `.npeid` may be copied.
+
+## Rotate config signing key (lab)
+
+```bash
+sudo python3 /opt/pfc/python/secure_messaging/../scripts/rotate_config_key.py
+# or from the repo:
+sudo python3 scripts/rotate_config_key.py \
+  --pem /opt/pfc/etc/sm-keys/config.ed25519.pem \
+  --signed /opt/pfc/etc/secure-messaging.signed.json \
+  --history /opt/pfc/data/admin/admin-history \
+  --actor rotate-lab
+```
+
+Writes a **new** PKCS8 PEM, re-signs the current payload, appends prev+new+diff
+to the admin-history cube. Old PEM is kept as `config.ed25519.pem.prev`.
+
+## Rotate NPE encryption key (lab)
+
+```bash
+sudo /opt/pfc/bin/npe keygen --rotate --id /opt/pfc/etc/npe/lab.seed
+```
+
+Inbox (`npe.inbox.<fp>`) stays stable. Previous enc keys are retained for
+`--keep-old` then `npe keygen --wipe-old --id ...`.
+
+## Production HSM (not on ns1)
+
+Guess until hardware is attached: PKCS#11 slot for Ed25519 config signatures;
+NPE seed never leaves the module. `PFC_CONFIG_KEY_PEM` is replaced by
+`PFC_CONFIG_KEY_PKCS11=pkcs11:token=...`. Unsigned wrappers still rejected.