docs: align user docs and repo docs with implementation

Reviewed all user-facing docs (src/docs/) and repo-level docs against
the actual code and fixed inaccuracies surfaced by the audit:

- README.md: fix CI badge URL (deploy.yml → ci.yml); replace tag-based
  "Deployment" section with the actual push-to-main flow; list all 5
  D1 tables instead of 2.
- RELEASE.md: delete (described a tag-based release process that does
  not exist; push-to-main auto-deploys per ci.yml).
- CLAUDE.md: add missing scripts (lint, validate, install:hooks); fix
  table count (4 → 5, add config_revisions); correct packages
  enrichment description; cross-link AGENTS.md + docs/HARNESS.md.
- src/docs/api-reference.md: rewrite to match the actual handlers —
  every endpoint shape (request/response/status), correct rate limits
  (CONFIG_READ/WRITE/SEARCH all 30/min), remove fabricated
  X-RateLimit-* headers, split dashboard /api/configs/:slug from CLI
  /:username/:slug/config, fix install endpoint Content-Type.
- src/docs/config-options.md: document validation limits — custom_script
  10K, dotfiles_repo HTTPS + 500, alias 2-20 chars + reserved words,
  packages 500/200; fix base_preset default; document
  snapshot.macos_prefs[].host.
- src/docs/personal.md: remove false "Dotfiles cloned and linked" line
  from the first install transcript (no dotfiles_repo configured yet).
- src/docs/teams.md: correct visibility guidance — private is
  owner-only (403 for other users), teams should use unlisted.
- src/docs/snapshot.md: "Before installing" → "Before applying" in the
  restore section.
- src/docs/what-is-openboot.md: spaced em-dash for style consistency.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: fullstackjam

CLAUDE.md

@@ -14,16 +14,21 @@ The CLI lives at [openbootdotdev/openboot](https://github.com/openbootdotdev/ope
 npm run dev                # Local dev server
 npm run build              # Production build
 npm run check              # Type checking (svelte-kit sync + svelte-check)
+npm run lint               # ESLint
+npm run validate           # check + lint + test (the harness gate)
 npm test                   # Run all tests (vitest)
 npx vitest run src/lib/server/auth.test.ts           # Run a single test file
 npx vitest run -t "test name"                        # Run test by name
 npm run test:coverage      # Tests with coverage report
+npm run install:hooks      # Install git pre-commit/pre-push hooks
 
 # Database
 wrangler d1 migrations apply openboot --local   # Apply migrations locally
 wrangler d1 migrations apply openboot --remote  # Apply migrations to production
 ```
 
+See [AGENTS.md](./AGENTS.md) for harness invariants (no `process.env`, no `console.log` in server code, D1 access scoping) and [docs/HARNESS.md](./docs/HARNESS.md) for the full enforcement model.
+
 Local dev requires `.dev.vars` with `GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET`, `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`.
 
 ## Architecture
@@ -57,7 +62,7 @@ Three auth flows:
 
 ### Database
 
-D1 (SQLite), no ORM — direct parameterized SQL via `env.DB.prepare(sql).bind(...)`. Four tables: `users`, `configs`, `api_tokens`, `cli_auth_codes`. The `configs.packages` field is a JSON array (stored as `{name, type}` objects; the config endpoint transforms to `{name, desc}` on read, filling descriptions from `package-metadata.ts`). Config visibility: `public` (discoverable), `unlisted` (accessible but not listed), `private` (owner-only, 403 on install).
+D1 (SQLite), no ORM — direct parameterized SQL via `env.DB.prepare(sql).bind(...)`. Five tables: `users`, `configs`, `config_revisions`, `api_tokens`, `cli_auth_codes`. The `configs.packages` field is a JSON array of `{name, type}` objects; on read, endpoints enrich each entry with a `desc` filled from `package-metadata.ts`. Config visibility: `public` (discoverable), `unlisted` (accessible but not listed), `private` (owner-only, 403 on install).
 
 **D1 limitation**: No `ALTER TABLE DROP COLUMN`. Plan column removals via new table + data migration.
 

README.md

@@ -2,7 +2,7 @@
 
 Web dashboard and install API for [OpenBoot](https://github.com/openbootdotdev/openboot).
 
-[![Deploy](https://github.com/openbootdotdev/openboot.dev/actions/workflows/deploy.yml/badge.svg)](https://github.com/openbootdotdev/openboot.dev/actions/workflows/deploy.yml)
+[![CI](https://github.com/openbootdotdev/openboot.dev/actions/workflows/ci.yml/badge.svg)](https://github.com/openbootdotdev/openboot.dev/actions/workflows/ci.yml)
 
 **Live at [openboot.dev](https://openboot.dev)**
 
@@ -41,21 +41,7 @@ GOOGLE_CLIENT_SECRET=...
 
 ## Deployment
 
-**Tag-based releases** — production deploys only happen when you create a version tag:
-
-```bash
-git tag v1.0.0
-git push origin v1.0.0
-```
-
-This triggers:
-1. Tests + build
-2. Database migrations
-3. Deployment to openboot.dev
-
-Push to `main` only runs CI (tests + build), no deployment.
-
-See [RELEASE.md](./RELEASE.md) for full release process.
+Push to `main` runs CI (type check + tests + build) and, on success, auto-deploys to [openboot.dev](https://openboot.dev). PRs run CI only. The deploy job lives in `.github/workflows/ci.yml`; see [docs/HARNESS.md](./docs/HARNESS.md) for the full pipeline.
 
 Secrets needed: `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`
 
@@ -82,7 +68,7 @@ Secrets needed: `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`
 
 ## Database
 
-D1 (SQLite). Two tables: `users` and `configs`. See `migrations/` for schema. Key fields:
+D1 (SQLite). Tables: `users`, `configs`, `config_revisions`, `api_tokens`, `cli_auth_codes`. See `migrations/` for schema. Key fields on `configs`:
 
 - `configs.packages` — JSON array of {name, type, desc}
 - `configs.snapshot` — JSON object from CLI `openboot snapshot`