wiki: add Use-Cases page + status framing on Home

Use-Cases.md : operator-facing FAQ-style reference. Scenarios :
  home appliance, salon demo, traveller OS, eye-square OTG,
  bridge headless. Plus a 12-row tweaks/gotchas table linking
  to the project memory + history entries.

Home.md : link Use-Cases in "Démarrer" section + add a status
blockquote framing the project as dev-alpha, all-in-the-pipe,
KISS, swiss-army-knife + modular OS appliance.

Home.md

@@ -19,6 +19,7 @@ La documentation technique couvre l'installation sur différentes cibles matéri
 - **[[Architecture]]** — Vue d'ensemble des six modules et de la stack technique
 - **[[Hardware-Matrix]]** — Matrice de compatibilité BYOH par carte et SoC
 - **[[Installation]]** — Guide d'installation complet (APT, Live USB, ARM)
+- **[[Use-Cases]]** — Scénarios terrain + tweaks par mode (home, salon, traveller, eye, bridge)
 - **[[Live-USB-VirtualBox]]** — Test rapide en machine virtuelle
 - **[[QEMU-ARM64]]** — Émulation ARM sur x86 pour développement
 - **[[Kiosk-Mode]]** — Mode kiosk fullscreen (Pi 400, live amd64)
@@ -26,6 +27,8 @@ La documentation technique couvre l'installation sur différentes cibles matéri
 - **[[Cross-Build-CI]]** — Le pipeline arm64 et la chaîne v2.13.x
 - **[[MODULES-EN|Modules]]** — Documentation des 139 paquets
 
+> **Statut (2026-06-02)** — Versioning dev alpha, release line v2.13.x **all-in-the-pipe working** : partly efficient, partly modules-integration ready, partly upgradeable, **first-point POC**. Design KISS. SecuBox vise à être un **OS complet pour outil sécurité — Swiss army knife + appliance modulaire**.
+
 ---
 
 ## Soutenir le projet

Use-Cases.md

@@ -0,0 +1,156 @@
+# Use Cases — SecuBox in the field
+
+## Project status (2026-06-02)
+
+SecuBox-DEB is in **dev alpha** versioning. The current release line (v2.13.x)
+is **all-in-the-pipe working** : the full stack flows end-to-end from build
+to flash to boot to dashboard, but the pieces are at different maturity levels :
+
+- **Partly efficient** — single boards (MOCHAbin, Pi 4/400) carry the whole
+  suite ; many subsystems still have headroom on resource use and startup time.
+- **Partly modules-integration ready** — the SecuBox Hub talks to ~100
+  modules, but mature integrations are a subset (auth, cookies, certs,
+  hub, portal, runtime, system, users today).
+- **Partly upgradeable** — APT repo at `apt.secubox.in` ships signed
+  arm64 + amd64 .debs from v2.13.4+ ; A/B rootfs upgrades and shared data
+  partitions are planned in [#446 Full Traveller OS](https://github.com/CyberMind-FR/secubox-deb/issues/446).
+- **First-point POC** — the project is the **proof of concept** that a
+  modular, libre, certifiable (CSPN) security appliance can live on
+  off-the-shelf BYOH hardware.
+
+The design philosophy is **KISS — Keep It Simple Stupid**. SecuBox aims
+to be a **full operating system** for a security tool — at once a
+**Swiss army knife** (pick the mode for the moment) and a **modular
+appliance OS** (every module is an installable package, every preset
+is a swappable profile).
+
+This page is the operator-facing counterpart of the
+[issue tracker](https://github.com/CyberMind-FR/secubox-deb/issues) — a
+use-case-oriented reference complementing the install/architecture docs.
+Each scenario answers "I want to do X — what does SecuBox look like here ?"
+and points at the tweaks/quirks/gotchas specific to that mode.
+
+---
+
+## 🏠 Home appliance — small office / home network
+
+**Hardware** : MOCHAbin (preferred) or ESPRESSObin. Wall-mounted or desk box, ethernet primary, optional WiFi AP via the on-board radio.
+
+**Image** : `secubox-mochabin-bookworm.img.gz` from the latest release.
+
+**What you get** :
+- Firewall + WAF (HAProxy + mitmproxy) + IDS (Suricata + CrowdSec) inline
+- Per-user dashboards via the SecuBox Hub (`https://admin.<your-domain>`)
+- Self-hosted Nextcloud, PeerTube, Matrix, Photoprism, Jitsi… as LXC apps
+- WireGuard mesh for laptop-on-the-road access back home
+
+**Quirks** :
+- Master users are always `gk2` + `admin` (every login-capable app must accept both — see [project_master_users](https://github.com/CyberMind-FR/secubox-deb/blob/master/.claude/memory/project_master_users.md))
+- NC bruteforce is OFF — the WAF in front of it is the brute-force layer
+- Default backend DB is SQLite (PhotoPrism complies, PeerTube needs Postgres)
+
+---
+
+## 🎪 Salon / trade-show demo — Pi 400 kiosk
+
+**Hardware** : Raspberry Pi 400 + HDMI display + USB mouse.
+
+**Image** : `secubox-rpi-arm64-bookworm.img.gz` from v2.13.12+ (the v2.13.4 image **doesn't ship a working kiosk** — see the [Cross-Build-CI page](Cross-Build-CI#kiosk-image-chain) for the journey).
+
+**What you get** :
+- Boots directly into Chromium fullscreen on `http://127.0.0.1/`
+- SecuBox login screen → admin dashboard, no Linux shell visible
+- Trimmed daemon set : only the kiosk web stack runs (~20 services
+  instead of 150 — see [#442](https://github.com/CyberMind-FR/secubox-deb/issues/442))
+- Mouse cursor visible (the `-nocursor` X flag was removed in v2.13.12,
+  [#444](https://github.com/CyberMind-FR/secubox-deb/issues/444))
+
+**Quirks** :
+- Out of the box, the kiosk image's `users.json` ships with
+  `password_hash: null` — needs an admin password seeded before first
+  boot (the live SD patch workflow used at the salon is documented in
+  [Kiosk-Mode#manual-enable](Kiosk-Mode#manual-enable))
+- Sudo NOPASSWD is required on the build host for the live SD patch
+  loop (mount p2 / sed / umount cycle)
+- The image is ~8 GB ; planned [#446](https://github.com/CyberMind-FR/secubox-deb/issues/446) kiosk-light profile cuts it to ~3-4 GB
+
+---
+
+## 🧳 Traveller OS — USB stick + any laptop
+
+**Hardware** : a single USB stick that boots on whatever hardware is at hand.
+
+**Image** : `secubox-live-amd64-bookworm.img.gz` for now (multi-arch and multi-rootfs are planned in [#446](https://github.com/CyberMind-FR/secubox-deb/issues/446)).
+
+**What you get** :
+- Plug into any x86_64 laptop → boot SecuBox live → kiosk login + dashboard
+- Persistent data partition (planned) keeps users + secrets + state across reboots and across machines
+- Validated in VirtualBox : NAT port-forward `2222→22 / 8080→80 / 8443→443 / 9080→9080`
+
+**Quirks** :
+- Worn USB sticks fail mid-flash silently — sticks of the same batch may have one good one good one dead ; the dev workflow is "test on a second stick before iterating the build script" (see [feedback_test_with_two_usb_sticks](https://github.com/CyberMind-FR/secubox-deb/blob/master/.claude/memory/feedback_test_with_two_usb_sticks.md))
+- The `secubox-otg-gadget` package is masked on the live USB by default — only activates on Eye-Square hardware (or via the planned multi-mode switcher of [#446](https://github.com/CyberMind-FR/secubox-deb/issues/446))
+
+---
+
+## 👁️ Eye-Square — USB OTG diagnostic tool (planned, #446)
+
+**Hardware** : Pi 4 in OTG gadget mode + the Eye-Square shell.
+
+**Image** : same `secubox-rpi-arm64-bookworm.img.gz`, switched to `otg` mode via the boot menu.
+
+**What you'll get** :
+- Plug Eye-Square's USB-C into any laptop
+- Host sees an ECM (network), ACM (serial console), and mass_storage device — a portable diagnostic tool
+- Run secubox-* APIs over the network gadget without any external network
+
+**Quirks** :
+- Requires the multi-mode boot menu to actually swap presets (currently masks all non-Eye services on rpi400 ; the inverse mask is needed for `otg` mode)
+- USB host laptop needs to accept the ECM device class (Linux : automatic ; Windows : driver dance ; macOS : automatic)
+
+---
+
+## 🛡️ Headless appliance — bridge / bump-in-the-wire
+
+**Hardware** : MOCHAbin / ESPRESSObin between WAN and LAN.
+
+**Image** : same `secubox-mochabin-bookworm.img.gz`, switched to `bridge` mode via the boot menu.
+
+**What you get** :
+- Transparent inline inspection of LAN ↔ WAN traffic
+- nftables drops by default ; only the rules you write explicitly let traffic through
+- CrowdSec aggregates traffic signals into bans, fed back to the firewall
+
+**Quirks** :
+- HAProxy + mitmproxy are mandatory for any externally-exposed vhost — the [WAF bypass interdiction](https://github.com/CyberMind-FR/secubox-deb/blob/master/CLAUDE.md#waf-bypass--interdiction-absolue) memo bans `waf_bypass` lines and any direct backend routing
+- WireGuard kernel native — no userspace `wg-quick` fallback
+- Once mitmproxy is in front, the [route registration](https://github.com/CyberMind-FR/secubox-deb/blob/master/CLAUDE.md#mitmproxy-route-configuration-complet) requires editing **both** `/srv/mitmproxy/haproxy-routes.json` and `/srv/mitmproxy-in/haproxy-routes.json` then `systemctl restart mitmproxy`
+
+---
+
+## 📚 Tweaks reference — the gotchas operators have hit
+
+| # | Topic | Memo |
+|---|-------|------|
+| 1 | Master users `gk2` + `admin` everywhere | [project_master_users](https://github.com/CyberMind-FR/secubox-deb/blob/master/.claude/memory/project_master_users.md) |
+| 2 | NC brute-force is intentionally OFF | [project_nc_bruteforce_disabled](https://github.com/CyberMind-FR/secubox-deb/blob/master/.claude/memory/project_nc_bruteforce_disabled.md) |
+| 3 | SQLite default backend (Postgres only for PeerTube) | [feedback_prefer_sqlite](https://github.com/CyberMind-FR/secubox-deb/blob/master/.claude/memory/feedback_prefer_sqlite.md) |
+| 4 | LXC-native apps (each app = own systemd unit), NOT Docker-in-package | [feedback_lxc_native_over_docker_package](https://github.com/CyberMind-FR/secubox-deb/blob/master/.claude/memory/feedback_lxc_native_over_docker_package.md) |
+| 5 | Never parallel-restart all secubox-* on the appliance | [feedback_no_mass_daemon_restart](https://github.com/CyberMind-FR/secubox-deb/blob/master/.claude/memory/feedback_no_mass_daemon_restart.md) |
+| 6 | Source-first ALWAYS — diff source vs board before deploying | [feedback_source_first_always](https://github.com/CyberMind-FR/secubox-deb/blob/master/.claude/memory/feedback_source_first_always.md) |
+| 7 | Cross-flash USB sticks before iterating build scripts | [feedback_test_with_two_usb_sticks](https://github.com/CyberMind-FR/secubox-deb/blob/master/.claude/memory/feedback_test_with_two_usb_sticks.md) |
+| 8 | CI artifact uses latest SUCCESSFUL build-packages run | [reference_ci_artifact_source](https://github.com/CyberMind-FR/secubox-deb/blob/master/.claude/memory/reference_ci_artifact_source.md) |
+| 9 | Blanket GPIO sweep can crash the board | [feedback_gpio_blanket_sweep_crashed_board](https://github.com/CyberMind-FR/secubox-deb/blob/master/.claude/memory/feedback_gpio_blanket_sweep_crashed_board.md) |
+| 10 | `.ini` drop-ins for PHP : use `;` for comments, NOT `#` | HISTORY 2026-05-31 |
+| 11 | arm64 cross-build requires `binutils-aarch64-linux-gnu` | HISTORY 2026-05-31 ([Cross-Build-CI](Cross-Build-CI)) |
+| 12 | qemu-arm64 chroot bookworm postinsts need `SYSTEMD_OFFLINE=1` wrapper + `policy-rc.d` + tmpfs `/boot/firmware` | HISTORY 2026-06-01 ([Cross-Build-CI#kiosk-image-chain](Cross-Build-CI#kiosk-image-chain)) |
+
+---
+
+## See also
+
+- [[Architecture]] — the six canonical modules
+- [[Kiosk-Mode]] — what `kiosk` mode does at runtime
+- [[Cross-Build-CI]] — the CI traps the build journey closed
+- [[Federation-OCM]] — how two SecuBox NCs share data
+- [Issue tracker](https://github.com/CyberMind-FR/secubox-deb/issues) — current and historical quirks