docs: enhance documentation with threat model, limitations, air-gapped guidance

- Update version to v1.4.4
- Add explicit threat model documentation
- Document known limitations prominently
- Include air-gapped usage recommendations
- Polish all documentation for clarity and examples
- Update README, DEVELOPMENT.md, GEMINI.md, RECOVERY_PLAYBOOK.md

GEMINI.md

@@ -2,10 +2,10 @@
 
 ## Project Overview
 
-**SeedPGP v1.4.3**: Client-side BIP39 mnemonic encryption webapp  
+**SeedPGP v1.4.4**: Client-side BIP39 mnemonic encryption webapp  
 **Stack**: Bun + Vite + React + TypeScript + OpenPGP.js + Tailwind CSS  
-**Deploy**: GitHub Pages (public repo: `seedpgp-web-app`, private source: `seedpgp-web`)  
-**Live URL**: <https://kccleoc.github.io/seedpgp-web-app/>
+**Deploy**: Cloudflare Pages (private repo: `seedpgp-web`)  
+**Live URL**: <https://seedpgp-web.pages.dev/>
 
 ## Core Constraints
 
@@ -314,9 +314,26 @@ await window.runSessionCryptoTest()
 
 ---
 
-## Current Version: v1.4.3
+## Current Version: v1.4.4
 
-*Please update the "Recent Changes", "Known Limitations", and "Next Priorities" sections to reflect the current state of the project.*
+**Recent Changes (v1.4.4):**
+- Enhanced security documentation with explicit threat model
+- Improved README with simple examples and best practices
+- Better air-gapped usage guidance for maximum security
+- Version bump with security audit improvements
+
+**Known Limitations (Critical):**
+1. **Browser extensions** can read DOM, memory, keystrokes - use dedicated browser
+2. **Memory persistence** - JavaScript cannot force immediate memory wiping
+3. **XSS attacks** if hosting server is compromised - host locally
+4. **Hardware keyloggers** - physical device compromise not protected against
+5. **Supply chain attacks** - compromised dependencies possible
+6. **Quantum computers** - future threat to current cryptography
+
+**Next Priorities:**
+1. Enhanced BIP39 validation (full wordlist + checksum)
+2. Multi-frame support for larger payloads
+3. Hardware wallet integration (Trezor/Keystone)
 
 ---