Document iteration 1: settings file, HA Dashboard tab, new hooks

README: settings file, --config, the new tab. ARCHITECTURE.md and
CLAUDE.md: prepare() hook, app command-line options, app code layout,
WebEngine notes, the moc raw-string pitfall. THIRD_PARTY_NOTICES: Qt
WebEngine. Ship config.example.json; the package README explains the
set-up. PROGRESS.md and DESIGN.md: phase 3 results and deviations.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/DESIGN.md

@@ -150,7 +150,7 @@ and signals across threads are delivered through the receiver's event loop.
 | **I/O wrappers** | Data sources and actuators; know nothing about HA. One wrapper object per OpenVR interface used (e.g. `IVRSystem`, `IVRApplications`, `IVRChaperone`, `IVRSettings`). System wrappers (network, audio) later. | OpenVR ✓, system ✗ |
 | **Overlays** | View and controller of MVC (QML), as dashboard tabs or world overlays. Get their data (the model) from other objects. | ✓ |
 | **Managers** | One object per stateful feature that manages and coordinates it, using entities, services and overlays. Notification manager (MVP); status card manager (SRV-6/7) later. | notifications ✓ |
-| **HA web UI** | Encapsulates Qt WebEngine for the dashboard tab (DSH-1; Q2 for DSH-2). | ✓ (DSH-1) |
+| **HA web UI** | Encapsulates Qt WebEngine for the dashboard tab (DSH-1; Q2 for DSH-2). `src/ha/HaWebUi`, a QML singleton in the app itself (not `frameassistant_lib`: QML types must be part of the QML module). | ✓ (DSH-1) |
 | **Configuration** | Settings from the JSON file, loaded once by the app as an immutable value. Each component gets the part it needs through its constructor (D19). | ✓ |
 | **App** | The managing object: owns all of the above as components and wires them together. | ✓ |
 
@@ -314,10 +314,12 @@ Layout follows common practice (e.g. Zigbee2MQTT's `…/<device>/set`); one topi
   code ≠ 0 (CFG-2, via the start-up hook D21).
 - Unknown keys: a warning in the log, no abort (catches typos without breaking across
   versions).
-- Password in plain text: warn if the file is readable by others; otherwise file permissions
-  (`chmod 600`).
+- Password in plain text: warn if the file holds a password and is readable by others;
+  otherwise file permissions (`chmod 600`). (Implemented this way: a readable file without a
+  password is harmless.)
 - Throttle intervals (SEN-14) are fixed per entity in the code for the MVP.
-- A `config.example.json` ships in the package.
+- A `config.example.json` ships in the package (`share/frameassistant/`); the package's
+  README.txt explains how to set it up.
 - To check on the Frame when TLS is implemented: where the system certificates are
   (`/etc/ssl/certs`?), for the `ca_file` default.