docs: product documentation, design working files, and the failed design review

Adds the required doc set under docs/mmd-pdf/ - PRD, feature backlog with
status and sign-off per feature, screens with wireframes, test cases with the
test data and the agent-tasking prompts, and the sign-off log.

The sign-off log records the independent design review of 2026-08-27:
DESIGN-FAIL, three blockers and five major findings, which is why every design
feature in the backlog is blocked and the logo/token branch is unmerged.

Design working files live in docs/mmd-pdf/design/ so the next agent can
regenerate and re-render them. redplate.css there is the MMD shell design
system lifted verbatim from the session that owns it - do not edit it.

Also carries the session handover.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/mmd-pdf/PRD.md

@@ -0,0 +1,74 @@
+# MMD PDF — product requirements
+
+| | |
+|---|---|
+| Version | 0.1 |
+| Date | 2026-08-27 |
+| Sign-off | **unsigned** |
+| Repo | `gitea.baobab-ts.com/mmd-it/mmd-pdf` |
+
+## What it is
+
+A PDF editor for MMD staff on Windows. Free, open source, no subscription, no
+account, nothing sent anywhere. It is a GPL-3.0 fork of KillerPDF 1.7.5 and
+stays GPL-3.0; `FORK-NOTICE.md` records what MMD changed.
+
+## Why it exists
+
+Staff need to write inside PDF documents — fill a delivery note, correct a
+figure, sign a form, mark up a drawing, turn a scan into searchable text.
+Until now there was no sanctioned tool. PDFgear was evaluated on 2026-07-20 and
+blocked: it forged the Windows default-PDF registry setting behind the consent
+screen, confirmed by its own paid auditor.
+
+## Who uses it
+
+- **Plant and office staff** across Dakar, Bamako, Kigali, Luanda, Conakry,
+  Ouagadougou and Dubai. Not computer people. Many read French, not English.
+- **Their screens are 800×600.** Every surface must work at that size. This is
+  a hard constraint, not a target.
+
+## In scope
+
+- Read a PDF, and change text that is already on the page.
+- Fill and sign forms, including comb fields, checkboxes and radio groups.
+- Mark up: highlight, draw, shapes, stamps, images, signatures.
+- Page work: merge, extract, delete, reorder, crop, rotate.
+- Turn a scan into searchable text (on-device, eleven languages).
+- Pull pages straight off a network copier. **Not built.**
+- Print.
+
+## Not in scope
+
+- Anything that leaves the machine. No cloud, no account, no telemetry.
+- Collaborative editing.
+- Creating documents from scratch — that is Word's job.
+
+## Hard requirements
+
+1. **An edited figure must be gone from the file, not covered over.** Upstream
+   painted a white box over the original text and drew the replacement on top;
+   extracting text returned both values. A corrected quantity on a delivery
+   note that leaves the building must not carry the old number inside it.
+2. **800×600.** See above.
+3. **The MMD shell design system** ("red plate"), light only, official MMD
+   lockup, red reserved for one primary action, focus, and urgency.
+4. **No admin rights needed** to install or run.
+5. **French and English** interface at minimum; the upstream base ships twelve
+   locales.
+
+## Data
+
+The user's own files on their own machine. Nothing else. No network calls
+except the optional download of a higher-accuracy text-recognition language
+pack, and the scanner on the local network once that is built.
+
+## Open questions
+
+- No official square MMD app mark exists. The icon crops the lockup's baobab
+  disc; it reads from 32px and is muddy at 16–24px.
+- Which of three toolbar treatments (see `SCREENS.md`) — the independent
+  reviewer recommends C.
+- Code signing. Re-signing under an MMD certificate resets the reputation the
+  upstream signed build has, and SmartScreen is set to block without an
+  override on the pilot group.