update docs and progress tracking

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

README.md

@@ -30,6 +30,7 @@ Complete storefront with all the pages you need:
 ### Technical highlights
 - Hand-written CSS with three-layer architecture (9.8 KB gzipped shop, 17.8 KB admin)
 - SQLite with BLOB storage, IMMEDIATE transactions, WAL, mmap
+- SQLCipher encryption at rest (AES-256, optional for dev, required for prod)
 - Image optimisation pipeline (AVIF/WebP/JPEG responsive variants via Oban)
 - ETS caching for CSS, pages, redirects, favicons
 - 99-100 PageSpeed mobile, no-JS support across all key flows
@@ -102,6 +103,59 @@ assets/css/
 └── theme-layer3-semantic.css    # component styles
 ```
 
+## Database encryption
+
+Berrypod uses SQLCipher to encrypt the entire SQLite database at rest. Two independent secrets provide defence in depth:
+
+| Secret | Purpose |
+|--------|---------|
+| `SECRET_KEY_BASE` | Phoenix sessions, Cloak field encryption |
+| `SECRET_KEY_DB` | SQLCipher whole-database encryption |
+
+### Development
+
+Encryption is optional for development. To test locally with encryption:
+
+```bash
+# Generate a key (hex-only recommended)
+openssl rand -hex 32
+
+# Set environment variable
+export SECRET_KEY_DB="your-hex-key"
+
+# Recreate database with encryption
+mix ecto.reset
+mix phx.server
+```
+
+Without `SECRET_KEY_DB`, the database is unencrypted.
+
+### Production
+
+Both secrets are required. Generate them:
+
+```bash
+mix phx.gen.secret  # → SECRET_KEY_BASE
+openssl rand -hex 32  # → SECRET_KEY_DB (or mix phx.gen.secret)
+```
+
+For Fly.io deployment:
+```bash
+fly secrets set SECRET_KEY_BASE="..." SECRET_KEY_DB="..."
+```
+
+### Backup and restore
+
+Admin > Backup provides:
+- Database stats (size, encryption status, table breakdown)
+- Download backup (encrypted with same key)
+- Restore from backup (validates key matches)
+
+**Key management:**
+- Lost key = lost data. No recovery possible.
+- Store keys securely (password manager, secrets manager).
+- Backups are portable — copy file + set same key = working shop.
+
 ## Stripe setup
 
 1. Create a [Stripe account](https://dashboard.stripe.com/register)