Add CODE_OF_CONDUCT and CONTRIBUTING documentation

.cursor/rules/120-git.mdc

@@ -2,5 +2,5 @@
 description: Git + release flow
 globs: "**/*"
 ---
-- Conventional commits. Branches: `develop` -> staging, `main` -> production (tag `v*` to release).
-- Small PRs; CI must pass (typecheck, lint, rules:check, tests, a11y, e2e) before merge.
+- Conventional commits. **`main`** → full CI + staging deploy; tag **`v*`** on `main` → production release.
+- Small PRs; run `npm run check` locally before merge (full CI runs on `main` only to save Actions minutes).

.github/CODEOWNERS

@@ -0,0 +1,8 @@
+# Default reviewers for all paths (501 take-home — solo maintainer).
+* @humza-butt
+
+# Infrastructure & security-sensitive areas
+/.github/ @humza-butt
+/apps/api/ @humza-butt
+/packages/db/ @humza-butt
+/SECURITY.md @humza-butt

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,67 @@
+name: Bug report
+description: Something broken in the app, API, or deploy pipeline
+title: '[bug]: '
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report. Include steps to reproduce and environment details.
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Web SPA
+        - API / Worker
+        - Database / RLS
+        - Real-time (WebSocket / DO)
+        - Media / R2
+        - CI / deploy
+        - Other
+    validations:
+      required: true
+
+  - type: dropdown
+    id: environment
+    attributes:
+      label: Environment
+      options:
+        - Local dev
+        - Staging
+        - Production
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Go to …
+        2. Click …
+        3. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behaviour
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behaviour
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / screenshots
+      description: Worker trace ID, browser console, or Playwright output if relevant.
+      render: shell

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security advisory
+    url: https://github.com/humza-butt/oche/security/advisories/new
+    about: Report a vulnerability privately (see SECURITY.md)
+  - name: Documentation
+    url: https://github.com/humza-butt/oche/tree/main/docs
+    about: Architecture, deployment, and interview prep docs

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,37 @@
+name: Feature request
+description: Propose an enhancement (venue UX, API, scale, etc.)
+title: '[feat]: '
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem / user story
+      description: Who is this for (venue staff, player, operator) and what pain does it solve?
+      placeholder: As a venue operator, I want … so that …
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Optional — what else did you think about?
+
+  - type: checkboxes
+    id: scope
+    attributes:
+      label: Likely touch points
+      options:
+        - label: Frontend (apps/web)
+        - label: API / Worker (apps/api)
+        - label: Database / migrations
+        - label: Docs / ADR
+        - label: CI / deploy

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,27 @@
+## Summary
+
+<!-- What changed and why (1–3 sentences). -->
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] Feature / enhancement
+- [ ] Refactor / DX
+- [ ] Docs only
+- [ ] CI / deploy
+
+## Checklist
+
+- [ ] `npm run check` passes locally
+- [ ] DB / RLS touched → `npm run db:rls:check` green
+- [ ] New env vars documented in `.env.example`
+- [ ] Rules touched → `npm run rules:sync`
+- [ ] No secrets or `.env` files committed
+
+## Test plan
+
+<!-- How you verified the change (commands, URLs, screenshots). -->
+
+## Screenshots / recordings
+
+<!-- Optional — UI changes welcome. -->

.github/SUPPORT.md

@@ -0,0 +1,24 @@
+# Support
+
+**Oche** is a 501 Cloud Developer take-home project — best-effort maintenance, not a SLA-backed product.
+
+## Quick links
+
+| Need                  | Where                                            |
+| --------------------- | ------------------------------------------------ |
+| Run locally           | [README — Quick start](../README.md#quick-start) |
+| Deploy staging / prod | [docs/DEPLOYMENT.md](../docs/DEPLOYMENT.md)      |
+| Architecture          | [ARCHITECTURE.md](../ARCHITECTURE.md)            |
+| Security              | [SECURITY.md](../SECURITY.md)                    |
+| Interview walkthrough | [docs/INTERVIEW.md](../docs/INTERVIEW.md)        |
+
+## Get help
+
+1. Search [existing issues](https://github.com/humza-butt/oche/issues).
+2. Open a [bug report](https://github.com/humza-butt/oche/issues/new?template=bug_report.yml) with repro steps and environment.
+3. For vulnerabilities, use [GitHub Security Advisories](https://github.com/humza-butt/oche/security/advisories/new) — do not file public issues.
+
+## Live environments
+
+- **Production:** https://oche.humza-butt.space
+- **Staging:** https://oche-staging.humza-butt.space

.github/actions/setup/action.yml

@@ -0,0 +1,13 @@
+name: Setup Oche
+description: Node.js + npm ci for Oche monorepo workflows
+runs:
+  using: composite
+  steps:
+    - name: Use Node.js from .nvmrc
+      uses: actions/setup-node@v4
+      with:
+        node-version-file: .nvmrc
+        cache: npm
+    - name: Install dependencies
+      run: npm ci
+      shell: bash

.github/dependabot.yml

@@ -0,0 +1,26 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+    commit-message:
+      prefix: chore
+      include: scope
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    labels:
+      - dependencies
+      - github-actions
+    commit-message:
+      prefix: chore
+      include: scope

.github/workflows/ci.yml

@@ -1,24 +1,106 @@
-name: ci
+# Full verification pipeline — runs on main only to keep CI minutes down.
+name: CI
+
 on:
-  push: { branches: [main, develop] }
-  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
-  build:
+  verify:
+    name: Verify
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with: { node-version-file: .nvmrc, cache: npm }
-      - run: npm ci
-      - run: npm run rules:check
-      - run: npm run typecheck
-      - run: npm run lint
-      - run: npm run coverage
-      - run: npm run build
-      - run: npm run size
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Agent rules in sync
+        run: npm run rules:check
+
+      - name: OpenAPI export in sync
+        run: |
+          npm run export:openapi
+          git diff --exit-code apps/web/public/openapi.json
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Format
+        run: npm run format:check
+
+      - name: Unit tests + coverage
+        run: npm run coverage
+
+      - name: Contract tests
+        run: npm run test:contracts
+
+      - name: Build all workspaces
+        run: npm run build
+
+      - name: Bundle size budget
+        run: npm run size
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@v4
+        id: playwright-cache
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+
       - name: Install Playwright
-        run: npx playwright install --with-deps
-      - run: npm run test:e2e
-      - uses: actions/upload-artifact@v4
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: npx playwright install --with-deps chromium
+
+      - name: Install Playwright deps (cache hit)
+        if: steps.playwright-cache.outputs.cache-hit == 'true'
+        run: npx playwright install-deps chromium
+
+      - name: End-to-end tests
+        env:
+          DATABASE_URL: ${{ secrets.DATABASE_URL }}
+          MEDIA_SIGNING_SECRET: ${{ secrets.MEDIA_SIGNING_SECRET }}
+          OCHE_JWT_SECRET: ${{ secrets.OCHE_JWT_SECRET }}
+        run: |
+          if [ -z "$DATABASE_URL" ]; then
+            echo "::warning::DATABASE_URL secret not set — skipping e2e (configure in repo Settings → Secrets)"
+            exit 0
+          fi
+          npm run test:e2e
+
+      - name: Upload Playwright report
+        uses: actions/upload-artifact@v4
+        if: always() && hashFiles('playwright-report/**') != ''
+        with:
+          name: playwright-report
+          path: playwright-report/
+          retention-days: 14
+
+      - name: Job summary
         if: always()
-        with: { name: playwright-report, path: playwright-report/ }
+        run: |
+          {
+            echo "## CI summary"
+            echo ""
+            echo "| Check | Status |"
+            echo "| --- | --- |"
+            echo "| Rules sync | ✅ |"
+            echo "| OpenAPI export | ✅ |"
+            echo "| Typecheck / lint / format | ✅ |"
+            echo "| Unit + contract tests | ✅ |"
+            echo "| Build + bundle budget | ✅ |"
+            echo "| E2E | see workflow log (skipped if no DATABASE_URL secret) |"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/codeql.yml

@@ -0,0 +1,31 @@
+# Static analysis — main only (free for public repos).
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+      - uses: ./.github/actions/setup
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

.github/workflows/dependency-review.yml

@@ -0,0 +1,16 @@
+# Flags risky dependency changes on PRs targeting main (lightweight — no build).
+name: Dependency review
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/dependency-review-action@v4