docs: update README and tech docs for BadgerDB and thumbnails

- Reflect BadgerDB integration for metadata storage in features and
  architecture diagrams
- Add thumbnail generation and static asset subdirectories to project
  layout
- Document _MB configuration variants for size limits
- List main API request surfaces in docs/tech.md for better developer
  reference
- Align documentation with recent architectural and routing changes

docs/tech.md

@@ -19,6 +19,20 @@ The app starts from `cmd/main.go`. The `warpbox run` command calls the server
 package, loads templates from `templates/*.html`, registers routes, mounts
 `/static`, starts the thumbnail worker, and serves HTTP.
 
+The main request surfaces are:
+
+- `GET /` for the upload box UI.
+- `GET /box/:id` for shared box pages.
+- `GET /box/:id/login` and `POST /box/:id/login` for password-protected boxes.
+- `GET /box/:id/download` for ZIP downloads.
+- `GET /box/:id/files/:filename` for individual file downloads.
+- `GET /box/:id/thumbnails/:file_id` for image previews.
+- `POST /box` for new upload box creation.
+- `POST /box/:id/files/:file_id/upload` for manifest-based uploads.
+- `POST /box/:id/files/:file_id/status` for upload status updates.
+- `POST /box/:id/upload` and `POST /upload` for legacy upload compatibility.
+- `/admin/*` for the admin UI and settings.
+
 ## Frontend
 
 The frontend is server-rendered HTML with vanilla JavaScript.
@@ -26,14 +40,15 @@ The frontend is server-rendered HTML with vanilla JavaScript.
 - Templates live in `templates/`.
 - Browser behavior lives in `static/js/app.js` and `static/js/box.js`.
 - Styling lives in `static/css/`.
-- Visual assets, fonts, icons, cursors, and sprites live under `static/`.
+- Visual assets, fonts, icons, cursors, popups, and sprites live under
+  `static/`.
 
 There is no frontend build step. The browser receives HTML from Gin templates
 and static assets directly from the Go server.
 
 ## Storage
 
-WarpBox uses the local filesystem instead of a database.
+WarpBox uses the local filesystem for box data and BadgerDB for app metadata.
 
 Uploaded boxes are stored under:
 
@@ -43,26 +58,30 @@ data/uploads/
 
 Each box directory contains uploaded files plus a `.warpbox.json` manifest.
 The manifest tracks file names, statuses, retention, password metadata,
-download options, and thumbnail state.
+download options, and thumbnail state. BadgerDB stores users, tags, sessions,
+and runtime settings overrides.
 
 ## Upload Flow
 
 ```mermaid
 sequenceDiagram
-    participant UI as Browser UI
-    participant API as Gin server
+    participant Browser as Browser UI
+    participant Server as Gin server
     participant Store as boxstore
     participant Disk as Local disk
 
-    UI->>API: POST /box
-    API->>Store: create manifest
-    Store->>Disk: write box directory + manifest
-    API-->>UI: box id + upload URLs
-    UI->>API: POST /box/:id/files/:file_id/upload
-    API->>Store: save file and update status
+    Browser->>Server: POST /box
+    Server->>Store: create box directory + manifest
+    Store->>Disk: write .warpbox.json
+    Server-->>Browser: box id + upload URLs
+    Browser->>Server: POST /box/:id/files/:file_id/upload
+    Server->>Store: save file and update manifest
     Store->>Disk: write file + manifest
-    UI->>API: GET /box/:id/status
-    API-->>UI: current file states
+    Browser->>Server: POST /box/:id/files/:file_id/status
+    Server->>Store: update file status
+    Store->>Disk: rewrite manifest
+    Browser->>Server: GET /box/:id/status
+    Server-->>Browser: current file states
 ```
 
 ## Download Flow
@@ -73,6 +92,20 @@ Users can download individual files when the box allows it. ZIP downloads are
 created on demand from the files currently marked complete. One-time download
 boxes force ZIP download and delete the box after a successful ZIP response.
 
+```mermaid
+flowchart LR
+    Shared[Shared box page]
+    File[Individual file download]
+    Zip[ZIP download]
+    OneTime[One-time ZIP only]
+    Delete[Delete box after success]
+
+    Shared --> File
+    Shared --> Zip
+    OneTime --> Zip
+    Zip --> Delete
+```
+
 ## Thumbnail Worker
 
 The thumbnail worker is a background goroutine. On each pass it scans upload
@@ -126,6 +159,9 @@ Primary environment variables:
 - `WARPBOX_THUMBNAIL_BATCH_SIZE`
 - `WARPBOX_THUMBNAIL_INTERVAL_SECONDS`
 
+Size limit settings accept `_MB` or `_BYTES` env names. `WARPBOX_ADMIN_ENABLED`
+accepts `auto`, `true`, or `false`.
+
 The HTTP listen address is configured through the CLI flag:
 
 ```bash
@@ -150,7 +186,8 @@ lib/models/models.go     Shared data structures
 
 ## Tests
 
-Existing tests currently focus on the storage layer. Run them with:
+Existing tests cover config, storage, server security, and metastore behavior.
+Run them with:
 
 ```bash
 go test ./...