Docs: last two stale storage refs in SPEC (JSON -> SQLite)

SPEC.md

@@ -53,8 +53,7 @@ Two moving parts, no database, no framework on the frontend.
   (steps 5+6; token is base64url of the master m3u8 URL)
 - `GET /api/history` / `POST /api/history` → **per-user** watch
   history with position, persisted to
-  `server/data/history/<user>.json` (50 kept, top 5 returned;
-  upsert per anime+episode).
+  `server/data/aniweb.db` (SQLite; upsert per anime+episode).
 - `GET /stream/{token}` → proxied HLS. Token = base64url of the
   upstream URL. Rewrites every non-comment line of m3u8 bodies to
   point back at `/stream/`; proxies master, variants, and segments
@@ -63,7 +62,7 @@ Two moving parts, no database, no framework on the frontend.
   is the exact upstream URL, so the browser disk cache serves re-opens
   and re-seeks without touching the proxy.
 - `GET /login` / `POST /login` / `POST /logout` → multi-user auth:
-  PBKDF2-SHA256 passwords (`server/users.py`; `users.json` 0600),
+  PBKDF2-SHA256 passwords (`server/users.py`; SQLite `aniweb.db`, 0600),
   signed 30-day cookie carrying the username, 5-fail/15-min
   in-memory lockout **per user**. Accounts are CLI-created only
   (`python -m server.users add|rm|list`) — no self-signup. One-time