feat!: optional fail-closed fallback, legend output, richer prompt & docs

BREAKING CHANGE: regex fallback is now opt-in (patterns no longer defaults
to presets.swiss). With no fallback an LLM failure throws AnonymizationError
(fail-closed) and the pre-filter is bypassed; at least one of llm/patterns is
required. AnonymizationResult gains a required `legend`; anonymizeChunks seed
is now { mapping, legend? } and returns legend.

- prompt: model may coin new UPPERCASE abbreviations and returns a 'legende'
  explaining every abbreviation used (French); backfilled by DEFAULT_LEGEND
- PatternDef.meaning surfaces in the legend; swiss/generic presets get meanings
- AnonymizationError (exported) wraps the cause on fail-closed
- README: drop the chatbot provenance line; add 'How it works' + nLPD sections
- 34 tests / 99% coverage; bump to 0.2.0

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -4,11 +4,34 @@ All notable changes to this project are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0] - Unreleased
+
+### Added
+
+- **`legend`** on every result — abbreviation → French meaning (`PER`→`Personne`, `M`→`Masculin`), safe to
+  forward to a downstream LLM so it understands the placeholder tokens. Backed by a built-in
+  `DEFAULT_LEGEND` so coverage is guaranteed even if the model omits entries.
+- The default prompt now lets the model **coin new uppercase abbreviations** for entities/attributes/
+  context it discovers and return their meanings in `legende`.
+- `PatternDef.meaning` — optional human label for a tag, surfaced in the `legend`. `presets.swiss`/
+  `presets.generic` ship French meanings.
+- `AnonymizationError` (exported) — thrown when anonymization can't complete and no fallback exists;
+  carries the originating error in `.cause`.
+
+### Changed (breaking)
+
+- **Regex fallback is now opt-in.** `patterns` no longer defaults to `presets.swiss`. With no fallback,
+  an LLM failure throws `AnonymizationError` (fail-closed) and the pre-filter is bypassed. At least one of
+  `llm` or `patterns` is required, or the constructor throws.
+- `AnonymizationResult` gained a required `legend` field; `LlmProvider.anonymizeBatch` returns `legend`.
+- `anonymizeChunks(chunks, seed)` — `seed` is now `{ mapping, legend? }` (was the bare mapping) and the
+  return includes `legend`.
+
 ## [0.1.0] - Unreleased
 
 ### Added
 
-- Initial public release, extracted from Mobiletic's production Swiss-nLPD chatbot.
+- Initial public release.
 - `Anonymizer` — pre-filter → LLM → regex fallback, bidirectional validation, deterministic coreference,
   and de-collision across question and retrieved chunks (`anonymize`, `anonymizeChunks`, `deanonymize`).
 - `makeStreamDeanonymizer` — streaming-safe de-anonymization that never leaks a split placeholder.