Bootstrap agent-ready docs and permissions (D-036)

Root AGENTS.md is now the single source of truth for coding agents;
CLAUDE.md, GEMINI.md and docs/CLAUDE.md are pointers. The product spec
moves from docs/CLAUDE.md to PRODUCT.md, DESIGN.md records the shipped
visual system, and docs/PERMISSIONS.md defines agent permission tiers
rendered to .claude/, .codex/ and .gemini/. Adds docs/specs/ and
docs/plans/, logs issues noticed (not fixed) in WorkBreakdown.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

PRODUCT.md

@@ -0,0 +1,40 @@
+# Product
+
+Whisper Web — on-device speech-to-text. A browser-first transcription app powered by OpenAI Whisper,
+running through [Transformers.js](https://github.com/huggingface/transformers) (`@huggingface/transformers`).
+(Moved here from the original `docs/CLAUDE.md` §1.)
+
+## Users and what they get
+
+**Anonymous users (no login) can:**
+- Run Whisper models fully in the browser — no audio or transcript leaves the device.
+- Choose which Whisper model to use (tiny → large, English-only and multilingual, quantized variants).
+- Keep working when the network — or our own server — is offline (installable PWA + cached model weights).
+- Accelerate inference with WebNN or WebGPU (auto-selected in that order, D-017; never WebGPU on
+  Firefox, D-026), falling back to WASM automatically.
+- Transcribe an uploaded audio/video file, or live from the microphone (D-016).
+- Export transcripts as `.txt` / `.srt` and manage cached model storage.
+
+**Logged-in users (Passport.js, when `AUTH_ENABLED`) get all of the above, plus:**
+- A toggle to choose where inference runs: **their own device** (browser engine) or **the server**
+  (server engine).
+- The server engine MUST use [faster-whisper](https://github.com/SYSTRAN/faster-whisper) (CTranslate2) —
+  not Transformers.js (D-013). faster-whisper cannot run in a browser, so the browser engine stays on
+  Transformers.js.
+
+## Product principles (from `docs/Architecture.md` §5)
+
+- **Privacy:** browser-engine audio never touches the network.
+- **Anonymous-first:** login only unlocks the server engine; nothing else is gated.
+- **Offline-first:** app shell + previously downloaded models work with no network.
+- **Honest status:** the UI must not claim a state it isn't in — e.g. "Downloading" vs "Loading model
+  from cache" (D-033), no "Listening" before the model is ready (D-034).
+- **User-initiated downloads:** selecting a model never downloads it (D-020); large models on mobile
+  get a warn/confirm gate (D-027–D-029).
+
+## Out of scope (from `docs/WorkBreakdown.md`)
+
+Arbitrary Hub model ids, OAuth providers, multi-user transcript storage, whisper.cpp server backend,
+i18n of the UI.
+
+TODO(maintainer): confirm target audience and tone of voice for UI copy — not recorded anywhere.