chore(docs): remove superseded tracking docs (content -> issues)

CLAUDE.md

@@ -131,5 +131,5 @@ headings, Inter for body — matching `web-app/src/theme.ts`.
   (`cb6eab9`, 2026-04-18). Rotation is operator-gated. Playbook: parent
   `docs/SECURITY_INCIDENTS.md`.
 
-See `docs/TODO.md` for the integration backlog and `ROADMAP_AUTH_2026-05-30.md` (parent) for
+See the open GitHub issues for the integration backlog and `ROADMAP_AUTH_2026-05-30.md` (parent) for
 the auth program tracker.

README.md

@@ -19,9 +19,10 @@ Google Authenticator or Microsoft Authenticator:
   tap-to-copy, swipe-delete confirmation, manual account entry
 
 The core engine lives in `shared/src/commonMain/kotlin/com/fivucsas/authenticator/totp/`
-via KMP `expect`/`actual`, so iOS and Desktop will reuse it once their HMAC
-actuals land (tracked in `docs/TODO.md`). QR code scanning is deferred; manual
-entry is the supported flow in 5.1.0.
+via KMP `expect`/`actual`; the Android, Desktop and iOS HMAC actuals are all
+implemented, so the engine is shared across platforms. QR-code account import
+is supported on Android (`OtpQrScannerScreen` + `OtpauthUri.parse()`) alongside
+manual entry.
 
 
 ## Feature coverage matrix

docs/MOBILE_TESTING_GUIDE.md

@@ -165,4 +165,4 @@ server **200** — always check the server verdict before assuming the API faile
 ## 8. Reference
 - `README.md`, `CLAUDE.md` — architecture & conventions.
 - `docs/RELEASE.md`, `docs/SIGNING.md` — signing & release.
-- `ROADMAP_CLIENT_APPS.md` — roadmap.
+- Open GitHub issues — current backlog / roadmap.