docs: record open questions and credential locations in the Proton Drive handoff

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

docs/plans/001-protondrive-tier1-HANDOFF.md

@@ -236,6 +236,25 @@ Later milestones, each needing its own plan: M5 (events and `ChangeNotify`),
 M6 (persistent metadata cache, rclone Metadata support, small-file
 single-request upload), M7 (upstream path, deferred by the owner).
 
+## Open questions for the owner
+
+Ask these before the work they block; none has been answered.
+
+1. **Usernames in git history.** The first handoff commit, `901d7fd5b`,
+   contained the two test-account usernames (no passwords or tokens). The
+   next commit, `85f6b2f0e`, removed them from the file, but they remain in
+   that commit's history on the Gitea remote. Removing them means
+   rewriting `master` from `901d7fd5b` onward and force-pushing, which the
+   repository's rules forbid and which was not done. The owner was asked
+   on 2026-11-11 whether they want that; no answer yet. Do not force-push
+   without an explicit yes.
+2. **Gitea Actions.** Does the owner's Gitea have an Actions runner? Task
+   18 adds `.gitea/workflows/ci.yml`, which cannot be verified locally.
+3. **Official CLI interop (Task 21).** Install a released Proton client
+   for it, or limit interop to the web app as done so far?
+4. **Rulings.** Section 7 lists 28 decisions made on the owner's behalf;
+   they were reported in summary and not confirmed one by one.
+
 ## 5. Test accounts and machine setup
 
 Machine-local, not in the repository. A new machine needs them recreated.
@@ -248,12 +267,21 @@ Machine-local, not in the repository. A new machine needs them recreated.
     `~/proton_rclone_test_acc_password`.
   - `TestProtonDrivePaid:` - paid account; password file
     `~/proton_paid_acc_password`. **Never signed in to yet.**
-  The usernames are in that rclone config (`rclone config show`), not in
-  this repository; on a new machine ask the owner for the accounts. Both
-  remotes are set up for password sign-in, which is what every live probe
-  used; browser sign-in has not been exercised against the real service.
-  Never print, paste, log or commit these passwords or any token, and never
-  put them in a subagent's prompt.
+  Where to find the credentials on this machine (never copy either value
+  into the repository, a commit message, a log or a subagent prompt):
+  - Username: the `username` key of each remote in
+    `~/.config/rclone/rclone.conf`; `rclone config show TestProtonDrive`
+    and `rclone config show TestProtonDrivePaid` print it. That output also
+    contains the obscured password and, for the free account, session
+    tokens, so do not paste it anywhere.
+  - Password: plain text in the two files named above, one per account.
+    The same password is stored obscured in the rclone config, so rclone
+    itself needs nothing more; read the files only if a test must supply
+    the password directly, and then pass it by file or environment, never
+    on a command line that gets logged.
+  Both remotes are set up for password sign-in, which is what every live
+  probe used; browser sign-in has not been exercised against the real
+  service. On a different machine, ask the owner for the accounts.
 - **Every `go test` must set `RCLONE_CONFIG=/notfound`**, e.g.
   `RCLONE_CONFIG=/notfound go test -race ./backend/protondrive/...`.
   Without it the live `TestIntegration` signs in to the real service on