chore: retarget at main, add the standard scaffolding and shared workflows

.github/CODEOWNERS

@@ -0,0 +1 @@
+*   @AuthPlane/authplane-eng

.github/ISSUE_TEMPLATE/bug-report.md

@@ -0,0 +1,68 @@
+---
+name: Bug Report
+about: Report a bug in the Authplane .NET SDK or an adapter
+title: "[Bug] "
+labels: bug
+assignees: ""
+---
+
+## Description
+
+A clear description of the bug.
+
+## Affected Package
+
+- [ ] `Authplane.Sdk` (core)
+- [ ] `Authplane.Mcp`
+
+## Steps to Reproduce
+
+1. Add the package reference to your `.csproj` ...
+2. Configure / call ...
+3. Observe ...
+
+Minimal reproducible code snippet:
+
+```csharp
+// paste here
+```
+
+## Expected Behavior
+
+What you expected to happen.
+
+## Actual Behavior
+
+What actually happened. Include stack trace, HTTP status codes, and relevant log output.
+
+## Environment
+
+- **Package version:** (e.g., `Authplane.Sdk 1.2.3`)
+- **Target framework:** (e.g., `net8.0`, `net10.0`)
+- **.NET SDK version:** (`dotnet --info`)
+- **OS:** (e.g., Ubuntu 22.04, macOS 14, Windows 11)
+- **Framework (if adapter):** (e.g., ASP.NET Core 10, ModelContextProtocol.AspNetCore 1.0.0)
+- **Authplane `authserver` version / issuer:** (if relevant)
+
+## Configuration
+
+Relevant SDK configuration (redact secrets):
+
+```csharp
+// paste here
+```
+
+## Logs
+
+<details>
+<summary>Relevant logs</summary>
+
+```
+(paste relevant logs here — redact any sensitive data, especially tokens)
+```
+
+</details>
+
+## Additional Context
+
+Any other relevant information.

.github/ISSUE_TEMPLATE/feature-request.md

@@ -0,0 +1,37 @@
+---
+name: Feature Request
+about: Suggest a new feature for the Authplane .NET SDK or an adapter
+title: "[Feature] "
+labels: enhancement
+assignees: ""
+---
+
+## Affected Package
+
+- [ ] `Authplane.Sdk` (core)
+- [ ] `Authplane.Mcp`
+- [ ] New package
+
+## Problem
+
+Describe the problem this feature would solve. What are you trying to do that you can't do today?
+
+## Proposed Solution
+
+Describe your proposed solution. How should this work? Include a rough API sketch if possible:
+
+```csharp
+// example usage
+```
+
+## Alternatives Considered
+
+What alternatives have you considered? Why is this approach better?
+
+## Use Case
+
+Describe the use case. Who benefits from this feature? Is this blocking integration with a specific framework or service?
+
+## Additional Context
+
+Any other relevant information, links to RFCs or specs, or examples from other projects.

.github/ISSUE_TEMPLATE/mcp-compatibility.md

@@ -0,0 +1,76 @@
+---
+name: MCP Compatibility Report
+about: Report compatibility of an MCP client or server with the Authplane .NET adapter
+title: "[Compat] <Client or Server> <Version>"
+labels: compatibility, mcp
+assignees: ""
+---
+
+## Adapter
+
+- [ ] `Authplane.Mcp` (MCP .NET adapter)
+
+## MCP Library Version
+
+- **Library:** (e.g., `ModelContextProtocol.AspNetCore`)
+- **Version:**
+- **Transport:** (e.g., streamable-http, stdio)
+
+## MCP Client (if reporting a client-side issue)
+
+- **Client:** (e.g., Claude Code, MCP Inspector, Cursor)
+- **Version:**
+- **Platform:** (macOS / Linux / Windows)
+
+## Authplane SDK Version
+
+- `Authplane.Sdk`:
+- `Authplane.Mcp`:
+- `authserver` (issuer):
+- **Target framework / .NET SDK version:** (`dotnet --info`)
+
+## Description
+
+Brief summary of the compatibility observation.
+
+## Compatibility Scenarios
+
+Check each that was tested. Mark pass / fail / skip.
+
+- [ ] **JWT validation** — protected tool accepts valid bearer token
+- [ ] **Scope enforcement** — tool-specific scope required and checked
+- [ ] **DPoP-bound tokens** — proof-of-possession verified end-to-end (if applicable)
+- [ ] **Token refresh** — client refreshes without losing session
+- [ ] **Metadata discovery** — adapter surfaces `WWW-Authenticate` / protected-resource metadata correctly
+- [ ] **Error handling** — expired, revoked, malformed tokens produce the expected error shape
+
+## Reproduction Steps
+
+1. Install adapter ...
+2. Configure MCP server with Authplane middleware ...
+3. Connect client ...
+4. Observe results
+
+## Logs
+
+<details>
+<summary>Server logs (adapter)</summary>
+
+```
+(paste relevant logs here)
+```
+
+</details>
+
+<details>
+<summary>Client logs</summary>
+
+```
+(paste relevant logs here)
+```
+
+</details>
+
+## Additional Context
+
+Screenshots, network traces, spec references, or upstream issues.

.github/dependabot.yml

@@ -0,0 +1,48 @@
+version: 2
+
+updates:
+  # NuGet — the solution at the root resolves both packable projects and the
+  # test projects together, so a single ecosystem block covers the tree.
+  - package-ecosystem: nuget
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    labels:
+      - dependencies
+      - dotnet
+    commit-message:
+      prefix: "deps"
+    open-pull-requests-limit: 10
+    groups:
+      # Only minor + patch updates are bundled. Majors fall out of the
+      # group and each gets its own PR so breaking changes are reviewed
+      # one at a time.
+      nuget-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # GitHub Actions
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    labels:
+      - dependencies
+      - ci
+    commit-message:
+      prefix: "ci"
+    open-pull-requests-limit: 5
+    groups:
+      # Same approach as the nuget group: bundle minor + patch, let
+      # majors open as individual PRs.
+      actions-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"

.github/pull_request_template.md

@@ -0,0 +1,33 @@
+## Summary
+
+Brief description of what this PR does and why.
+
+## Linked Issue
+
+<!-- e.g., #123, or leave blank if N/A -->
+
+## Changes
+
+-
+
+## Affected Projects
+
+- [ ] `Authplane.Sdk` (core)
+- [ ] `Authplane.Mcp`
+- [ ] None (infra / docs / CI only)
+
+## Test Plan
+
+How was this tested? Include relevant test names or manual verification steps.
+
+## Checklist
+
+- [ ] `dotnet build Authplane.slnx --configuration Release` passes
+- [ ] `dotnet format Authplane.slnx --verify-no-changes` is clean
+- [ ] `dotnet test` passes for affected projects
+- [ ] Coverage thresholds met (80 line / 70 branch)
+- [ ] Tests added for new functionality
+- [ ] Documentation updated (if applicable)
+- [ ] `CHANGELOG.md` entry added under `[Unreleased]` (if user-facing)
+- [ ] New workflow actions are SHA-pinned (`pinact run` after changes)
+- [ ] No token values, secrets, or key material in logs or test fixtures