docs: new config files, scaled art caches, media widget privacy

README.md

@@ -103,8 +103,12 @@ see [`docs/ANDROID.md`](docs/ANDROID.md) for exact setup and release signing.
   a local HTTP server: there is no port for another process on the machine to ask
   for the plaintext, and mpv is handed an opaque token rather than a URL that
   would put a share secret in its log and window title.
-- The block cache holds decrypted content. It lives in your cache directory and
-  can be deleted at any time the app is not running.
+- The block cache holds decrypted content. It lives in your cache directory,
+  can be deleted at any time the app is not running, and can be sized or
+  emptied from Settings → Storage.
+- The desktop's media widget is handed the title, the episode and a `file://`
+  path to artwork already on disk — never a provider URL, so the shell never
+  contacts a metadata provider on its own.
 
 ## License
 

docs/ARCHITECTURE.md

@@ -120,4 +120,7 @@ an edge case.
 | Catalog | data dir, `catalog.db` | Yes — recrawl |
 | Watch state | same DB, own table | **No** — deliberately survives a recrawl |
 | Block cache | cache dir, `blocks/` | Yes — must work correctly after deletion |
-| Poster thumbnails | cache dir, `thumbs/` | Yes — refetched per file, one small decrypt each |
+| Poster thumbnails | cache dir, `thumbs/` | Yes — refetched per file, one small decrypt each; stored scaled to 640 px |
+| Provider artwork | cache dir, `posters/` | Yes — refetched by URL; stored scaled to 640 px |
+| Desktop-only settings | config dir, `desktop.json` | Defaults if missing — hardware decoding, cache budget; never overwritten when unparseable |
+| Window size | config dir, `window.json` | Defaults if missing or implausible |