docs: Document SYN-001 sync blocker

@@ -0,0 +1,81 @@1+# SYN-0012+3+## Summary4+5+SYN-001 is the Peach Sync blocker.6+7+Peach Sync's native Rust host uses Noise NK for peer authentication, but the8+responder side currently creates its static private key with an all-zero9+placeholder:10+11+- `native/peach-sync-host/src/tcp.rs`12+- Marker: `NoiseBridge::new_responder(&[0u8; 32])`13+14+That means every Peach install would present the same responder identity.15+Noise NK depends on the responder static key being real and device-specific, so16+with `[0u8; 32]` authentication is effectively broken and impersonation becomes17+trivial.18+19+## Why It Matters20+21+Sync is a high-trust path. It can move encrypted vault state between devices and22+depends on device identity being meaningful.23+24+If every responder uses the same static private key:25+26+- a peer cannot reliably authenticate that it is talking to the intended Peach27+  device;28+- any attacker who knows the placeholder identity can impersonate a responder;29+- mDNS discovery and local-network transport become dangerous to enable;30+- re-adding `nativeMessaging` would expose a high-risk extension permission for31+  a path that is not safe yet.32+33+## Why It Has Not Been Resolved Yet34+35+It is not just a one-line replacement. A proper fix needs a small dedicated36+sync sprint:37+38+1. Make `native/peach-sync-host` compile cleanly.39+2. Generate a per-install X25519 keypair.40+3. Persist the private key in the appropriate platform store or a clearly41+   scoped native-host config file.42+4. Advertise only the public key through mDNS.43+5. Bind pairing and trusted-device records to the real public key.44+6. Define key rotation and recovery behavior.45+7. Add handshake tests for distinct identities, impersonation rejection, and46+   paired-device acceptance.47+8. Re-audit the native host before re-enabling any live code path.48+49+Current project rules keep sync dormant until that work is done:50+51+- `.agent/Projects.md` says `nativeMessaging` must not be re-added until52+  SYN-001 is fully resolved.53+- `.agent/Projects.md` also says not to wire any code path to54+  `connectSyncHost()` and not to touch `native/` except in a dedicated SYN-00155+  fix sprint.56+- `src/background/sync.ts` is marked dormant and says not to import or re-enable57+  sync without completing the SYN-001 fix sprint and full native-host re-audit.58+59+## Current State60+61+The risky path is not shipped:62+63+- neither browser manifest includes `nativeMessaging`;64+- no live code path calls `connectSyncHost()`;65+- the Android wiring work intentionally did not enable sync or mDNS;66+- the native host still needs compile fixes and a security pass before use.67+68+## Suggested Fix Plan69+70+Treat SYN-001 as its own unit of work:71+72+1. Create a Koh checkpoint before touching `native/`.73+2. Fix the native host compile errors without changing protocol behavior.74+3. Add persisted per-install Noise identity.75+4. Wire the identity into advertise, discover, connect, and accept paths.76+5. Add Rust tests around key generation, persistence, handshake success, and77+   impersonation failure.78+6. Add extension-side tests for sync gating.79+7. Re-enable `nativeMessaging` only after the audit passes.80+81+Until then, sync should remain dormant.