docs(wiki): record M4 and M5 and the zig-sdk 0.4.0 pin
Architecture.md: add the modules oauth and embed, the sections on the HTTP upstream and the embedded bridge, the HTTP status rules of the listen stream, and the limits and error causes of M4.
Home.md: describe the bridge at M5 on main at 64bb1e2, set zig-sdk to 0.4.0 at 8334b15 (the tag v0.4.0) and update the row of the vscode bridge.
Package-Model.md: add the OAuth identity, the redirect port, the client ID metadata document and vscode.serveStdio, and apply the page to 8334b15 and 64bb1e2.
Roadmap.md: mark M4 (PR #6) and M5 (PR #7) as done with their details, mark changes J and K as merged, and record the open items for the browser opener, the discover default and the Dependabot pull requests.
Threat-Model.md: add the M4 requirements for secrets, headers, URLs, the browser opener, the loopback receiver, consent and token storage, add the threats of the embedded bridge, and remove a claim that the code does not support.
Translation-Rules.md: add the sign-in during initialize, the icon rule of a remote upstream server, the M4 error causes, the HTTP status rules, and the M5 rules for the first line, discover, the two paths and the end of input.
VS-Code.md: add the URL form options, sign-in and accounts, the steps to sign out, token storage, the environment limits and the bridge in a zig-sdk server, and update the exit codes, the stop and the Copilot harness rows.