docs: document App Attest protocol 3
Document device-bound renewable sessions
Document PumpSync component versioning policy
docs: link to repo-canonical reference instead of duplicating it Backend-Operations.md's "Data Deletion Tooling" section reproduced the exact CLI commands from the backend's docs/data-deletion.md -- now a one-line pointer to that runbook, which stays canonical since it's reviewed in the same PR as the tool it documents. Also links the previously-orphaned docs/security-and-privacy.md from App-Store-and-Privacy.md, and updates the docs/legal/ bullet in Home.md to describe the new website-pointer structure. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
docs: rewrite self-host/demo walkthrough, fix broken quickstarts Self-Hosting-and-Demo.md is now a full step-by-step guide (demo connection steps, self-host via published image or source build, TLS requirement, troubleshooting) instead of a thin config summary. Every documented backend quickstart that failed at startup (Getting Started, Testing and Verification) now includes the signing-key generation step or the minimum env for a bare dotnet run — they previously shipped the rejected placeholder key. Architecture and Features-and-Modes updated for the timezone/basal-id/dataSourceMode wire changes; Backend-Operations corrected on image tagging. Includes the maintainer's pending PumpSync-Backend -> PumpSync.backend naming pass across these same pages. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
docs: link public policy pages from wiki
docs: build out PumpSync wiki