Docs: host wiki pages in-repo with working links; fix two Settings defaults

.github/wiki/Home.md

@@ -23,13 +23,13 @@ Your laptop and the desk share one login session (standard Screen Sharing shares
 
 | Page | What it covers |
 |---|---|
-| [Installation](Installation) | Clone, `install.sh`, Accessibility grant, password setup, DisplayLink, uninstall |
-| [Settings](Settings) | Every option in the settings window explained |
-| [How It Works](How-It-Works) | Lifecycle walkthrough, the physical-vs-remote trick, DisplayLink caveat |
-| [Security](Security) | Threat model, input-filter limits, password storage, the optional helper, distribution trust |
-| [Architecture](Architecture) | 12-module breakdown, macOS APIs, data flow |
-| [Lessons Learned](Lessons-Learned) | What was discovered building this, including what did not work |
-| [Troubleshooting](Troubleshooting) | Common problems and fixes |
+| [Installation](Installation.md) | Clone, `install.sh`, Accessibility grant, password setup, DisplayLink, uninstall |
+| [Settings](Settings.md) | Every option in the settings window explained |
+| [How It Works](How-It-Works.md) | Lifecycle walkthrough, the physical-vs-remote trick, DisplayLink caveat |
+| [Security](Security.md) | Threat model, input-filter limits, password storage, the optional helper, distribution trust |
+| [Architecture](Architecture.md) | 12-module breakdown, macOS APIs, data flow |
+| [Lessons Learned](Lessons-Learned.md) | What was discovered building this, including what did not work |
+| [Troubleshooting](Troubleshooting.md) | Common problems and fixes |
 
 ## Requirements
 

.github/wiki/How-It-Works.md

@@ -4,7 +4,7 @@
 
 When you use macOS Screen Sharing, your laptop and the physical Mac share one login session. There is no separate "remote session" at the OS level. It is the same desktop, the same running apps, the same input system.
 
-That creates a real problem: you cannot put up a window that blocks input from the desk, because that would also block your remote input. And you cannot put up a click-through window (one that ignores the desk), because then desk keyboard and mouse still reach your apps. Several approaches hit this wall. See [Lessons Learned](Lessons-Learned) for the full list.
+That creates a real problem: you cannot put up a window that blocks input from the desk, because that would also block your remote input. And you cannot put up a click-through window (one that ignores the desk), because then desk keyboard and mouse still reach your apps. Several approaches hit this wall. See [Lessons Learned](Lessons-Learned.md) for the full list.
 
 The solution is to work below the window system. Curtain inspects every input event before any app sees it, and classifies each one by where it came from.
 

.github/wiki/Settings.md

@@ -118,7 +118,7 @@ The text shown when Cover style is set to Message.
 
 Overlays the current time on the cover. Lets the person at the desk see the machine is alive and on time.
 
-Default: **on**.
+Default: **off**.
 
 ---
 
@@ -179,7 +179,7 @@ What happens to the remote session when the correct password is entered at the d
 - **Keep session active** — the curtain drops and the remote operator stays connected.
 - **Disconnect remote** — the curtain drops and the active remote session is ended.
 
-Default: **keep session active**.
+Default: **disconnect remote**.
 
 ### Password box timeout
 
@@ -213,7 +213,7 @@ If no password has been set, the default password `curtain` is accepted. The win
 
 Lets Curtain end the remote session for the idle and session-end actions. This is **off by default** because it needs elevated rights.
 
-Turning it on installs a privileged helper. On a notarized or Developer-ID-signed build, Curtain registers a daemon through `SMAppService.daemon`, which prompts for one approval in System Settings. On a local ad-hoc or dev build, Curtain falls back to a small privileged helper installed with one admin prompt, scoped to the current user. A public notarized build never installs a sudoers rule. The helper performs the disconnect; macOS respawns the listener so new connections stay possible. See [How It Works](How-It-Works).
+Turning it on installs a privileged helper. On a notarized or Developer-ID-signed build, Curtain registers a daemon through `SMAppService.daemon`, which prompts for one approval in System Settings. On a local ad-hoc or dev build, Curtain falls back to a small privileged helper installed with one admin prompt, scoped to the current user. A public notarized build never installs a sudoers rule. The helper performs the disconnect; macOS respawns the listener so new connections stay possible. See [How It Works](How-It-Works.md).
 
 Default: **off**.
 

README.md

@@ -41,7 +41,7 @@ shasum -a 256 Curtain-1.0.0.dmg
 
 ## Settings
 
-Everything is a setting. Open the window from the menu-bar curtains icon or by reopening `Curtain.app`. Changes take effect immediately. You control arming, what the desk sees (solid color, message, blur, lock logo, Curtain logo, or aerial video), the reveal trigger, the idle and disconnect actions, the idle source (remote session activity or physical HID), the password and idle timeout, what happens to the remote session on unlock, per-display cover scope, password-box placement, and DisplayLink marking. See the [Settings](../../wiki/Settings) page for the full reference.
+Everything is a setting. Open the window from the menu-bar curtains icon or by reopening `Curtain.app`. Changes take effect immediately. You control arming, what the desk sees (solid color, message, blur, lock logo, Curtain logo, or aerial video), the reveal trigger, the idle and disconnect actions, the idle source (remote session activity or physical HID), the password and idle timeout, what happens to the remote session on unlock, per-display cover scope, password-box placement, and DisplayLink marking. See the [Settings](.github/wiki/Settings.md) page for the full reference.
 
 ## Multi-display note
 
@@ -56,7 +56,7 @@ Curtain covers every physical display. The Apple Screen Sharing app shows one ho
 
 ## Documentation
 
-The [wiki](../../wiki) covers everything in depth: [Installation](../../wiki/Installation), [Settings](../../wiki/Settings), [How It Works](../../wiki/How-It-Works), [Architecture](../../wiki/Architecture), [Security](../../wiki/Security), [Lessons Learned](../../wiki/Lessons-Learned), and [Troubleshooting](../../wiki/Troubleshooting).
+The [documentation](.github/wiki/Home.md) covers everything in depth: [Installation](.github/wiki/Installation.md), [Settings](.github/wiki/Settings.md), [How It Works](.github/wiki/How-It-Works.md), [Architecture](.github/wiki/Architecture.md), [Security](.github/wiki/Security.md), [Lessons Learned](.github/wiki/Lessons-Learned.md), and [Troubleshooting](.github/wiki/Troubleshooting.md).
 
 ## License