docs: add url shortener documentation

README.md

@@ -22,6 +22,7 @@ A lightweight, secure pastebin REST API built with Flask.
 - **Security headers** - HSTS, CSP, X-Frame-Options, X-Content-Type-Options
 - **CLI client** - Standalone `fpaste` tool with encryption support
 - **Request tracing** - X-Request-ID for log correlation
+- **URL shortener** - `/s/` endpoints for creating, resolving, and managing short URLs
 - **Audit logging** - PKI certificate lifecycle events (issue, revoke, auth failure)
 - **Observability** - Request duration metrics via Prometheus histogram
 - **Minimal dependencies** - Flask + SQLite, optional cryptography for CLI
@@ -57,6 +58,11 @@ python run.py
 | `GET /pastes` | List user's pastes (requires auth) |
 | `GET /register/challenge` | Get PoW challenge for registration |
 | `POST /register` | Register and get client certificate |
+| `POST /s` | Create short URL (PoW required) |
+| `GET /s` | List your short URLs (requires auth) |
+| `GET /s/<id>` | Redirect to target URL (302) |
+| `GET /s/<id>/info` | Short URL metadata |
+| `DELETE /s/<id>` | Delete short URL (requires auth) |
 | `GET /pki` | PKI status and CA info |
 | `GET /pki/ca.crt` | Download CA certificate |
 
@@ -102,6 +108,18 @@ curl -H "X-SSL-Client-SHA1: <your-cert-fingerprint>" \
      http://localhost:5000/pastes
 ```
 
+### Create a short URL
+```bash
+curl -X POST -H "Content-Type: application/json" \
+     -d '{"url":"https://example.com/long/path"}' \
+     http://localhost:5000/s
+```
+
+### Follow a short URL
+```bash
+curl -L http://localhost:5000/s/AbCdEfGh
+```
+
 ## CLI Client
 
 A standalone command-line client `fpaste` is included. For E2E encryption, install the optional `cryptography` package.
@@ -280,6 +298,8 @@ Configuration via environment variables:
 | `FLASKPASTE_RATE_WINDOW` | `60` | Rate limit window (seconds) |
 | `FLASKPASTE_RATE_MAX` | `10` | Max requests per window (anon) |
 | `FLASKPASTE_RATE_AUTH_MULT` | `5` | Multiplier for authenticated users |
+| `FLASKPASTE_SHORT_ID_LENGTH` | `8` | Short URL ID length (base62 characters) |
+| `FLASKPASTE_SHORT_URL_MAX` | `2048` | Maximum target URL length |
 | `FLASKPASTE_URL_PREFIX` | (empty) | URL prefix for reverse proxy deployments |
 | `FLASKPASTE_MIN_ENTROPY` | `0` | Min entropy bits/byte (0=disabled, 6.0=require encryption) |
 | `FLASKPASTE_MIN_ENTROPY_SIZE` | `256` | Only check entropy for content >= this size |
@@ -419,7 +439,7 @@ flaskpaste/
 │   └── api/
 │       ├── __init__.py  # Blueprint setup
 │       └── routes.py    # API endpoints
-├── tests/               # Test suite (356 tests)
+├── tests/               # Test suite (346+ tests)
 ├── data/                # SQLite database
 ├── run.py               # Development server
 ├── wsgi.py              # Production WSGI entry
@@ -444,6 +464,7 @@ flaskpaste/
 - **Security headers** - HSTS, CSP, X-Frame-Options, X-Content-Type-Options
 - **Proof-of-work** - Computational puzzles prevent automated spam
 - **Rate limiting** - Per-IP throttling with X-RateLimit-* headers
+- **Open redirect prevention** - URL shortener allows only http/https schemes with valid host
 - **Request tracing** - X-Request-ID for log correlation
 - **PKI support** - Built-in CA for client certificate issuance
 - **Audit logging** - PKI certificate events for compliance and forensics