[0xDeon]

Adds four backend docs under apps/backend/docs/:

• api-operational-endpoints.md: /health, /metrics, /me, /security/transport-policy and the dev-only /local-storage server, with auth, global rate-limit exemption, /health semantics, /metrics protection and the exact /local-storage mount condition.
• concepts-prekey-replenishment.md: PREKEY_LOW_THRESHOLD, the Redis/in-process latch and what releases it, the prekeys_low event, the 200-key cap and offline-device recovery.
• contracts-key-material.md: every accepted key type with encoding and byte length, raw vs SPKI conversion, signed-prekey signature coverage, and valid/rejected examples.
• howto-add-socket-event.md: ordered checklist with worked example, dispatcher pre-handler checks, invariants, error shape, testing and doc updates.

Notes found while documenting: the socket rate limiter keys on the Socket.IO event name (dispatch), so per-type buckets in SOCKET_EVENT_BUCKETS are not effective for dispatched events today; api-websocket-events.md is stale (legacy raw emit, 24h replay TTL) and was left unchanged.

Closes #623
Closes #621
Closes #620
Closes #616

[drips-wave]

@0xDeon Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits