docs: document new features, ops env vars, and API surface; refresh roadmap

- README: feature map updated (redirect types, protected links, QR vector
  export, audience analytics, API keys, admin observability, operations);
  API reference covers new endpoints and params. Roadmap now lists
  self-serve accounts, security hardening (rate limiting/CSRF/SSRF guard),
  Stripe billing, custom domains, and remaining power features.
- INSTALL: new environment variables (WEBHOOK_URL, GEOIP_DB_PATH,
  GEO_API_FALLBACK, IP_ANONYMIZE, CLICK_RETENTION_DAYS, BACKUPS,
  BACKUP_DIR, BACKUP_KEEP) with GeoLite2 setup notes and the ip-api.com
  licensing caveat.
- api-docs page: API-key authentication, new link/analytics/QR params,
  aggregate analytics, admin overview/audit/keys/purge, unlock route.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

INSTALL.md

@@ -124,7 +124,7 @@ Click **Apply**.
 - Add a proxy host: your domain → `unraid-lan-ip:5000`
 - Issue a Let's Encrypt certificate on the SSL tab
 - Keep `COOKIE_SECURE=false` — same reason as Cloudflare
-- Country detection falls back to ip-api.com (free, no key required, <45 req/min)
+- For country analytics without Cloudflare, mount a free MaxMind GeoLite2-Country database at `GEOIP_DB_PATH` (see Environment Variables), or set `GEO_API_FALLBACK=true` for non-commercial deployments
 
 **Step 5 — Verify**
 ```bash
@@ -175,6 +175,14 @@ Then click **Force Update** on the container in the Docker tab.
 | `DEBUG` | `false` | Flask debug mode — keep `false` in production |
 | `COOKIE_SECURE` | `false` | Set `true` only if Flask receives HTTPS directly (not behind a proxy) |
 | `DB_PATH` | `/app/data/qrknit.db` | SQLite file path — leave as-is when using a Docker volume |
+| `WEBHOOK_URL` | *(empty)* | Slack/Discord-compatible webhook — notified on new contact messages |
+| `GEOIP_DB_PATH` | `/app/data/GeoLite2-Country.mmdb` | Local MaxMind GeoLite2 country database for click geolocation. Download from maxmind.com (free account) and mount into the data volume. Preferred over any network lookup. |
+| `GEO_API_FALLBACK` | `false` | Enable ip-api.com lookups when no GeoLite2 DB is present. **Their free tier is licensed for non-commercial use only and rate-limited (~45 req/min)** — behind Cloudflare you don't need this (the `CF-IPCountry` header is used automatically). |
+| `IP_ANONYMIZE` | `none` | Privacy policy for stored click IPs: `none`, `truncate` (zero the host part), or `hash` (SHA-256 — unique-visitor counting still works) |
+| `CLICK_RETENTION_DAYS` | `0` | Purge click events older than N days (0 = keep forever) |
+| `BACKUPS` | `true` | Daily SQLite backup via `VACUUM INTO` |
+| `BACKUP_DIR` | `<db dir>/backups` | Where daily backups are written |
+| `BACKUP_KEEP` | `7` | Number of daily backups to retain |
 
 ---