docs: add #34 user-scoped viewer tokens, remove SUGGESTIONS.md

- CLAUDE.md: document planned user-scoped token scope (account_id filter)
- TODO.md: add #34 spec, drop stale SUGGESTIONS.md reference
- SUGGESTIONS.md: deleted — fully superseded by TODO.md + CLAUDE.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

TODO.md

@@ -1,6 +1,6 @@
 # TODO — Pending features and sustainability
 
-Quick overview of what's still to be done. Full details in [SUGGESTIONS.md](SUGGESTIONS.md).
+Quick overview of what's still to be done.
 
 ---
 
@@ -48,6 +48,20 @@ Fixed by adding `M365DriveNotFound(M365Error)` exception, raising it from `_get(
 
 ---
 
+### #34 — User-scoped viewer tokens
+Extend viewer token scope from `{"role": "student"|"staff"}` to also support `{"user": "alice@school.dk"}`, filtering `flagged_items` by `account_id`. Lets a single employee see only their own flagged files.
+
+**Infrastructure already in place:** `account_id` is an indexed column on `flagged_items`, populated for M365 (UPN) and Google (email). File-scan items have `account_id = ""` and won't appear in user-scoped views — document this in the token-creation UI.
+
+**Changes needed:**
+1. Token creation UI — add a "specific user" option (email input) alongside the role dropdown
+2. `GET /api/db/flagged` — filter by `account_id` when `session["viewer_scope"].get("user")` is set (same pattern as existing role filter)
+3. Viewer header — show locked identity (similar to locked `#filterRole` for role-scoped tokens)
+
+**Size:** Small · **Priority:** Medium
+
+---
+
 ### #32 — Windowed mode for Profiles, Sources, and Settings ✗ Won't do
 The workflow is sequential (configure → scan → review), not parallel — there is no realistic scenario where a modal and the results grid need to be open simultaneously. The Sources panel is already visible in the sidebar. Option A (the least-work path) still loads the full 3800-line JS stack twice. Closed.