Added groups and restricted access.

README.md

@@ -139,3 +139,37 @@ own icon/entry in ZimaOS's app store the way bundled apps do — that would
 need a CasaOS-format AppStore manifest (icon, category, metadata) submitted
 separately, which is a reasonable next step if you want it to feel fully
 native rather than "a compose file I pasted in."
+
+## Groups and access control
+
+Admin isn't a hardcoded flag — it's the built-in "Admin" group, which can't
+be deleted but is otherwise just a group like any other. Manage groups
+(create, delete, edit membership) from Settings → Groups (admin-only).
+
+Setting access on a file or directory is **not** admin-only — anyone can
+restrict a file or directory to specific users and/or groups, whether at
+creation time (the New File/New Directory dialog includes a search-and-
+checkbox picker) or afterwards via the 🔒 button next to any entry, in
+either the sidebar tree or the directory-browse pane. If you can currently
+see something, you're trusted to change who else can. Admins additionally
+bypass every restriction, so they can always troubleshoot.
+
+Restricting is per-file-or-directory — locking a directory covers everything
+inside it automatically (there's only ever one restriction record per locked
+directory; reaching anything underneath still requires being permitted on
+that ancestor), while locking an individual file affects only that file.
+
+Anyone without access gets a plain 404, both for direct requests and for
+that entry showing up in a directory listing — a restricted item's existence
+isn't revealed to people who can't see it. Admins get a global overview of
+every current restriction from Settings → Locked Directories.
+
+## Blame privacy
+
+Each person can turn off "Show my edits in others' blame view" in their own
+Settings. When that's off, other users still see that lines were changed —
+just with the identity redacted, rather than attributing it to someone who
+asked not to be shown. You can always see your own attribution regardless of
+this setting. There's also a per-viewer toggle for showing avatars instead
+of usernames in the blame gutter, using each author's chosen colour either
+way.