docs: fix MDX build (drop HTML comment, switch adr/ links to absolute URLs)

The W3 docs commit (31284d4) introduced two Docusaurus-incompatible
patterns that broke the deploy build:

1. An HTML comment '<!-- ─── W3: ... ───── -->' separating the W2
   threat-model rows from the W3 additions. Docusaurus 3 parses these
   files as MDX and a bare-! in column 2 is treated as a JSX
   element start. Comment removed — it was a visual divider, the
   heading immediately below carries the same intent.

2. Markdown links to '../adr/0009...md' and '../adr/0010...md'. The
   adr/ tree is outside the Docusaurus plugin's content root
   (preset.docs.path is ../docs only), so the link checker bails
   with 'couldn't be resolved'. Switched to absolute github.com
   URLs which the link checker leaves alone.

Local 'npm --prefix website run build' is now clean. Same fix
pattern as commit c9750f4.

Author: pulkitpareek18

docs/api_contract.md

@@ -129,7 +129,7 @@ All require `X-API-Key: <ADMIN_API_KEY>`. Read-only.
 
 ### Proof pairing (`/v1/proof-pairing/*`)
 
-Cross-device verification flow: a desktop opens a session, a phone scans the QR + generates a Groth16 proof, the desktop submits the proof, the backend mints a desktop JWT. Full protocol in [ADR-0009](../adr/0009-qr-proof-pairing-protocol.md).
+Cross-device verification flow: a desktop opens a session, a phone scans the QR + generates a Groth16 proof, the desktop submits the proof, the backend mints a desktop JWT. Full protocol in [ADR-0009](https://github.com/zeroauth-dev/ZeroAuth/blob/main/adr/0009-qr-proof-pairing-protocol.md).
 
 | Method | Path | Scope | Description |
 |---|---|---|---|

docs/threat_model.md

@@ -129,16 +129,14 @@
 | **Mitigation** | All inline handlers were removed; forms now use `addEventListener` from a single `<script>` block. CSP is enforced. |
 | **Test status** | Live `curl … | grep onsubmit=` returns 0 in CI. Could be promoted to a real test. |
 
-<!-- ─── W3: QR-proof pairing (Android phone → desktop) ─────────────── -->
-
 ### A-11 — Pairing-nonce replay across two desktop sessions
 
 | | |
 |---|---|
 | **Class** | Spoofing (STRIDE: S) |
 | **Surface** | `POST /v1/proof-pairing/sessions/:id/submit` |
 | **Description** | A passively-recorded `{proof, publicSignals, did}` from session S1 is replayed against a freshly-issued session S2 whose nonce the attacker observes (shoulder-surf of the desktop QR). Without an explicit nonce ↔ proof binding the same proof verifies for any session because `identityBinding = Poseidon(2)([biometricSecret, didHash])` is per-user, not per-session. |
-| **Mitigation** | [ADR-0009](../adr/0009-qr-proof-pairing-protocol.md) Option B′: phone computes `didHashSession = Poseidon(2)([didHash, sessionNonce])` and uses it as the circuit's `didHash` input. Server re-derives `Poseidon(2)([user.didHash, session.nonce])` from its own records and `crypto.timingSafeEqual`-compares to `publicSignals[1]`. Mismatch → 400 `pairing_nonce_mismatch`. |
+| **Mitigation** | [ADR-0009](https://github.com/zeroauth-dev/ZeroAuth/blob/main/adr/0009-qr-proof-pairing-protocol.md) Option B′: phone computes `didHashSession = Poseidon(2)([didHash, sessionNonce])` and uses it as the circuit's `didHash` input. Server re-derives `Poseidon(2)([user.didHash, session.nonce])` from its own records and `crypto.timingSafeEqual`-compares to `publicSignals[1]`. Mismatch → 400 `pairing_nonce_mismatch`. |
 | **Test status** | **Required before merge.** `tests/proof-pairing.test.ts` cases: (i) valid first submit succeeds; (ii) replay against same session returns 409; (iii) replay against fresh session with different nonce returns 400 with `pairing_nonce_mismatch`. |
 | **Audit signal** | `audit_events.action = 'pairing.replay_blocked'` with `metadata.session_id`. |
 
@@ -204,7 +202,7 @@
 | **Class** | Tampering (STRIDE: T) |
 | **Surface** | The Android app's WebView running snarkjs |
 | **Description** | If snarkjs is loaded over HTTPS at runtime, a CDN/network compromise swaps it for a build that exfiltrates `biometricSecret` (the only private witness) or produces proofs against attacker-chosen commitments. Same class as `event-stream` / `ua-parser-js`. |
-| **Mitigation** | [ADR-0010](../adr/0010-android-webview-snarkjs-bundling.md): snarkjs is bundled in the APK at `android/app/src/main/assets/prover/`, SHA-256 pinned in the ADR, build fails on mismatch. WebView CSP: `default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; connect-src 'none'`. WebView in a separate renderer process. No `file://`, no `content://`, no DOM storage. Play Integrity verdict travels in `clientMeta.playIntegrityVerdict` for W4 server-side enforcement. |
+| **Mitigation** | [ADR-0010](https://github.com/zeroauth-dev/ZeroAuth/blob/main/adr/0010-android-webview-snarkjs-bundling.md): snarkjs is bundled in the APK at `android/app/src/main/assets/prover/`, SHA-256 pinned in the ADR, build fails on mismatch. WebView CSP: `default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; connect-src 'none'`. WebView in a separate renderer process. No `file://`, no `content://`, no DOM storage. Play Integrity verdict travels in `clientMeta.playIntegrityVerdict` for W4 server-side enforcement. |
 | **Test status** | **Required before Android app merge.** CI step diffs `assets/prover/*.sha256` against the ADR-pinned table; build fails on mismatch. |
 | **Audit signal** | If `clientMeta.snarkjsHash` ever travels in the submit, log mismatches as `audit_events.action = 'pairing.unexpected_prover_hash'`. |