AUD-003: document canary webhook data disclosure in Entry settings UI and messages.ts

@@ -847,6 +847,12 @@847847         }848848         return { ok: true, data: await setPasskeyProviderEnabled(enabled) };849849       }850+      // AUD-003: this handler POSTs `entryTitle` to a user-configured HTTPS851+      // endpoint. Intentional product behavior — users configure their own852+      // dead-man's-switch. isAllowedCanaryWebhookUrl blocks localhost, private853+      // IPs, and non-HTTPS schemes, but cannot defend against every DNS-854+      // rebinding case. The UI under CanarySection (Entry.tsx) discloses to855+      // users that the entry title leaves the device when the canary fires.850856       case "FIRE_CANARY_PING": {851857         const { webhookUrl, entryTitle, trigger } = msg.payload as {852858           webhookUrl: string;

@@ -1582,6 +1582,9 @@15821582             onInput={(e) => setWebhookUrl(e.currentTarget.value)}15831583             onBlur={() => void save()}15841584           />1585+          <p style="font-size:10px;color:var(--peach-t2);margin:4px 0 0;line-height:1.5;">1586+            When triggered, the entry title is sent to this URL. Use an endpoint you control.1587+          </p>15851588           <input15861589             class="peach-inline-input"15871590             placeholder="label (optional, e.g. AWS decoy)"