Document current state and roadmap

- AGENTS.md: add Current state section; record Gitea origin; scrub the
  dev password example to a placeholder and the deploy host to a config
  reference.
- Add ROADMAP.md for longer-term backlog and deferred decisions.

ROADMAP.md

@@ -0,0 +1,26 @@
+# ROADMAP
+
+Longer-term backlog and deferred decisions. Near-term status lives in `AGENTS.md` → Current state; package-specific follow-ups live in `s9pk/TODO.md`.
+
+## Phase 3 — AI coach (deferred, not started)
+
+- Integrate the DGX Spark LLM box (Qwen3.6 35B, OpenAI-compatible endpoint) as a training coach.
+- Login-time training suggestions based on recent activity and goals.
+- Per-category drill ideas on demand.
+- Config via env-var names (endpoint URL, model); no keys in the repo.
+
+## Product backlog
+
+- **"Log another"**: allow multiple sessions of the same category in one day (the category pill currently edits the existing entry instead of creating a second).
+- **Speed units**: option for `km/h` in addition to `mph`.
+- **Per-metric direction**: expose a "higher is better / lower is better" toggle in the Settings metric editor (today it is set only via seed/migration; needed for new lower-is-better metrics like time or strokes).
+
+## Platform / packaging
+
+- **Password UX under StartOS**: make the in-app Settings password change agree with the "Set Login Password" action — hide the in-app field on StartOS, or write changes through to `store.json`.
+- **Packaging hygiene**: the vendored `s9pk/app/` is gitignored, so the package `gitHash` does not reflect app-source changes; revisit before publishing to a registry.
+- **Other arches**: build aarch64/riscv64 only if a target host needs them (currently x86_64-only).
+
+## Ops
+
+- `origin` is configured on self-hosted Gitea (SSH, in `.git/config`); push after committing.