Enhance documentation and fix static file handling

.github/pull_request_template.md

@@ -0,0 +1,47 @@
+## Summary
+
+<!-- One paragraph: what does this PR do and why? -->
+
+## Type of Change
+
+- [ ] Bug fix (non-breaking)
+- [ ] New feature (non-breaking)
+- [ ] Breaking change (requires version bump + CHANGELOG entry)
+- [ ] Refactor (no behaviour change)
+- [ ] Documentation update
+- [ ] CI / tooling change
+
+## Security Checklist
+
+<!-- Required for any change touching auth, token, oauth, rbac, or middleware -->
+
+- [ ] No secrets, API keys, or credentials added to source
+- [ ] Input validation added/updated for new endpoints
+- [ ] RBAC permissions verified for new/changed routes
+- [ ] Rate limiting considered for new public endpoints
+- [ ] Audit log event added for new auth actions
+- [ ] Cookie options unchanged (httpOnly, Secure, SameSite)
+- [ ] No token data exposed in URLs, logs, or response bodies
+
+## Testing
+
+- [ ] Unit tests added / updated
+- [ ] Integration tests added / updated
+- [ ] All existing tests pass (`npm test`)
+- [ ] Coverage threshold maintained (≥80%)
+
+## Documentation
+
+- [ ] JSDoc added for public functions / classes
+- [ ] `docs/api-reference.md` updated if endpoints changed
+- [ ] `docs/rbac-model.md` updated if permissions changed
+- [ ] `CHANGELOG.md` entry added (or handled by semantic-release)
+- [ ] `.env.example` updated if new env vars added
+
+## Linked Issues
+
+Closes #<!-- issue number -->
+
+## Screenshots / Logs (if UI or behaviour change)
+
+<!-- Paste relevant logs, screenshots, or curl examples -->

CODE_OF_CONDUCT.md

@@ -58,7 +58,7 @@ representative at an online or offline event.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders at **logusivam@gmail.com**. All complaints
+reported to the community leaders at **logusivam26@gmail.com**. All complaints
 will be reviewed and investigated promptly and fairly.
 
 All community leaders are obligated to respect the privacy and security of the

CONTRIBUTING.md

@@ -9,3 +9,55 @@ Thank you for your interest in contributing.
 - A GitHub account
 
 ## Setup
+
+1. **Clone the Repository**
+
+   ```bash
+   git clone https://github.com/logusivam/tokenforge.git
+   cd tokenforge
+   ```
+
+2. **Install Dependencies** This project uses npm workspaces. Run install from
+   the root:
+
+   ```bash
+   npm install
+   ```
+
+3. **Start Infrastructure Services** TokenForge requires MongoDB and Redis. Use
+   Docker Compose to spin them up locally:
+
+   ```bash
+   npm run docker:up
+   ```
+
+4. **Environment Variables Config** Copy the example environment configuration
+   files:
+   - For backend (`apps/api`): Copy `apps/api/.env.example` to `apps/api/.env`
+     and fill in secrets (e.g. `JWT_PRIVATE_KEY`, `JWT_PUBLIC_KEY`,
+     `COOKIE_SECRET`, `MONGO_URI`, `REDIS_URL`).
+   - For frontend (`apps/web`): Copy `apps/web/.env.example` to `apps/web/.env`
+     and update API endpoints.
+
+5. **Start Development Servers** Run the full monorepo dev stack (API + Web
+   app):
+
+   ```bash
+   npm run dev
+   ```
+
+6. **Running Tests** Run the test suites across all packages:
+   ```bash
+   npm run test
+   ```
+
+## Development & Git Workflow
+
+- **Branch Naming**: Branch out from `dev` using descriptive names like
+  `feature/oauth-flow` or `bugfix/token-rotation`.
+- **Commit Messages**: We enforce Conventional Commits. Use prefix types like
+  `feat(auth):`, `fix(deps):`, `docs(readme):`, `chore:`, etc. Commits that
+  violate this will fail hooks.
+- **Pull Requests**: Pull requests must target the `dev` branch. CI checks
+  (linting, typescript compilation, unit/integration tests) must pass
+  successfully before merging.

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Dark (logusivam)
+Copyright (c) 2026 logusivam vision
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -21,8 +21,10 @@
 
 ## Live Demo
 
-🔗 [tokenforge.dev](https://tokenforge.dev) ·
-[API Docs](https://tokenforge-api.railway.app/api/docs)
+🔗 **Frontend**:
+[tokenforge-dev.vercel.app](https://tokenforge-dev.vercel.app)  
+🔗 **API Docs (Swagger)**:
+[tokenforge-api-ecix.onrender.com/api/docs](https://tokenforge-api-ecix.onrender.com/api/docs)
 
 ---
 
@@ -87,12 +89,33 @@ graph TD
 ```
 tokenforge/
 ├── apps/
-│   ├── api/          # TypeScript Express API Backend
-│   └── web/          # React Vite SPA Frontend
-├── packages/         # Shared Monorepo Workspaces
-├── docus/            # Architectural documentation
-├── docker-compose.yml
-└── package.json
+│   ├── api/                    # TypeScript Express API Backend
+│   │   ├── src/
+│   │   │   ├── config/         # DB, Redis, Sentry, and Swagger setups
+│   │   │   ├── middleware/     # Rate limiter, RBAC, Sanitization, Error handler
+│   │   │   ├── modules/        # Auth, OAuth providers, Users, RBAC, Support, Token modules
+│   │   │   ├── shared/         # Constants, custom logger, response utilities
+│   │   │   └── server.ts       # Application bootstrap and server entry
+│   │   ├── tests/              # Unit & Integration test suites
+│   │   ├── package.json
+│   │   └── tsconfig.json
+│   └── web/                    # React Vite SPA Frontend
+│       ├── public/             # Static assets (Favicons, Logo, robots.txt, sitemap.xml, security.txt)
+│       ├── src/
+│       │   ├── components/     # UI forms, navigation layout, feedback widgets
+│       │   ├── hooks/          # React hooks (useAuth, etc.)
+│       │   ├── pages/          # Auth, Login, Dashboard, Admin, Profile pages
+│       │   ├── router/         # ProtectedRoutes and react-router tree
+│       │   ├── services/       # Axios API client handlers
+│       │   ├── store/          # Zustand global auth state management
+│       │   └── main.tsx        # React client entry point
+│       ├── package.json
+│       ├── tailwind.config.js
+│       └── vite.config.ts
+├── packages/                   # Shared Monorepo workspaces / helper utilities
+├── docus/                      # Architecture and system documentation
+├── docker-compose.yml          # Local database orchestrations (MongoDB & Redis)
+└── package.json                # Monorepo workspace configuration
 ```
 
 </details>

SECURITY.md

@@ -2,10 +2,10 @@
 
 ## Supported Versions
 
-| Version | Supported |
-|---|---|
-| Latest (`main`) | ✅ |
-| Older tags | ❌ No backport patches |
+| Version         | Supported              |
+| --------------- | ---------------------- |
+| Latest (`main`) | ✅                     |
+| Older tags      | ❌ No backport patches |
 
 ## Reporting a Vulnerability
 
@@ -15,21 +15,23 @@
 2. Click **"Report a vulnerability"**
 3. Fill in the template
 
-Send details to: **security@tokenforge.dev**  
-PGP key available at: `https://tokenforge.dev/.well-known/security.txt`
+Send details to: **devbridgeenquirz@gmail.com**  
+PGP key available at:
+`https://tokenforge-dev.vercel.app/.well-known/security.txt`
 
 ## Response Timeline
 
-| Stage | SLA |
-|---|---|
-| Acknowledgement | 48 hours |
-| Severity assessment | 5 business days |
+| Stage               | SLA                                 |
+| ------------------- | ----------------------------------- |
+| Acknowledgement     | 48 hours                            |
+| Severity assessment | 5 business days                     |
 | Fix + patch release | 14 days (critical) / 30 days (high) |
-| Public disclosure | 90 days after fix (coordinated) |
+| Public disclosure   | 90 days after fix (coordinated)     |
 
 ## Scope
 
 In scope for responsible disclosure:
+
 - Authentication bypass
 - Refresh token theft or reuse bypass
 - RBAC privilege escalation
@@ -39,6 +41,7 @@ In scope for responsible disclosure:
 - NoSQL injection
 
 Out of scope:
+
 - Denial of service via resource exhaustion (no SLA)
 - Social engineering
-- Issues in third-party dependencies (report to upstream)
+- Issues in third-party dependencies (report to upstream)