docs: mark P1 identity foundation done; bank degraded-identity UI warning

Record the persistent-identity foundation as landed (d157d78) and add the
user's requirement: surface a persistent UI warning (not just a log) when the
key can't be read/written, since running on an ephemeral fallback silently
breaks friend recognition next launch. To build with the regenerate UI slice.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/contacts-plan.md

@@ -71,11 +71,31 @@ peerspeak?") stays on Signal/Telegram — peerspeak is not a messenger.
 ## Core primitives to build
 
 ### P1 — Persistent identity (+ regenerate) — Small, foundational
-Port pixelpass's `identity.rs` (~140 lines, near-verbatim) → stable key file (JSON,
-not TOML). Swap `core/mod.rs:421`. Settings regenerate control (confirm + warn).
-**Spike first:** verify same-relay reachability by node ID without discovery on
-`iroh = 1.0.0-rc.0` (a saved `EndpointAddr` should resolve while the peer stays on
-the same relay). This underpins the whole presence story.
+**Foundation DONE (`d157d78`, 2026-06-15):** `src/identity.rs` (`load_or_create` /
+`regenerate` / `save` over a `0600` hex key file at `~/.config/peerspeak/identity.key`,
+atomic write, malformed = hard error, path-injectable fs seam + 8 unit tests incl.
+create/persist/regenerate/perms). Core loop now loads the stable key instead of
+`generate()` (falls back to ephemeral only if the file can't be read/written). The
+key file is raw hex (a secret, not structured config — JSON/TOML only matters for
+the friends store). 238 lib tests green, clippy clean, release builds.
+**Remaining in P1:**
+- **Settings "Regenerate identity" control** (confirm + warn) — `regenerate()`
+  exists; UI + a `CoreCommand` that rebuilds the live endpoint with the new key
+  still to wire.
+- **Visual warning when the key can't be read/written** (user, 2026-06-15). Today
+  the ephemeral fallback only logs — it must surface a **persistent** UI indicator,
+  because running unsaved is a real degraded state (your id won't survive the next
+  launch → friends stop recognising you). Plan: a dedicated `UiEvent`
+  (`IdentityNotPersisted(reason)`, distinct from the transient `Error` →
+  `status_message`), an `identity_degraded: Option<String>` flag in app state, and
+  a standing badge + a fuller explainer in the identity Settings section ("Identity
+  couldn't be saved to `~/.config/peerspeak/identity.key` — friends won't recognise
+  you next launch; check disk/permissions"). Build alongside the regenerate UI
+  slice (same identity Settings section + `CoreCommand` path).
+- **Spike:** verify same-relay reachability by node ID without discovery on
+  `iroh = 1.0.0-rc.0` (a saved `EndpointAddr` should resolve while the peer stays
+  on the same relay). Underpins the whole presence story; do during 2-machine
+  testing.
 
 ### P2 — Friends list — Small
 Persist friends = `{ node_id, display_name, last_known_addr }` (JSON store, atomic