chore: rewrite README and expand .gitignore for standalone repo

The README left over from filter-repo described the in-monorepo draft.
Replace it with a quick-start aimed at brew/go install users. Expand
.gitignore with .DS_Store, dist/, .env, and runtime data files.

Author: kanywst

.gitignore

@@ -1,4 +1,13 @@
+.DS_Store
 bin/
+dist/
+*.log
 *.pid
+
+# Runtime data
 config.json
 learned-rules.jsonl
+
+# Local env
+.env
+.env.local

README.md

@@ -1,43 +1,58 @@
 # approval-hub
 
-複数の Claude Code セッションの PreToolUse 許可プロンプトを 1 画面 (TUI)
-に集約する broker daemon と、それを呼ぶ Claude Code plugin の組合せ。
-
-実装は本リポ内 `0-draft/approval-hub/` 配下。完成時に以下へ分割する。
-
-- 本体 (daemon + TUI + matcher 学習 store): 別リポ `kanywst/approval-hub`
-- plugin wrapper: `../../plugins/approval-hub/`
-
-## 何を解くか
-
-複数の Claude Code セッション (別ターミナル / tmux pane) を並走させると、
-各セッションが個別に yes/no プロンプトを出して把握しきれない。これを 1
-画面に集約し、`y` / `n` / `a` (allow always + matcher 学習) / `d`
-(deny always) で捌けるようにする。
-
-## 技術メモ
-
-- PreToolUse hook の `type: "http"` で、各セッションから
-  `http://127.0.0.1:<port>/decide` に POST
-- payload の `session_id` + `cwd` でセッション識別
-- broker が落ちてたら `"defer"` を返して従来の手動 prompt に escalate
-  (壊れない)
-- TUI: Bubble Tea (Go)
-- セキュリティ: 127.0.0.1 限定 listen、Bearer token は env var
-  (`APPROVAL_HUB_TOKEN`) を `allowedEnvVars` 経由で hook に渡す
-
-### 返却 JSON 例
-
-```json
-{
-  "hookSpecificOutput": {
-    "hookEventName": "PreToolUse",
-    "permissionDecision": "allow|deny|ask|defer",
-    "permissionDecisionReason": "..."
-  }
-}
+Aggregate Claude Code permission prompts from multiple sessions into one
+terminal UI. Pair with the [approval-hub plugin] for Claude Code; the
+plugin embeds the broker's bearer token into `hooks/hooks.json` at
+install time.
+
+## Install
+
+```bash
+brew install kanywst/tap/approval-hub
+# or
+go install github.com/kanywst/approval-hub/cmd/approval-hub@latest
+```
+
+## Quick start
+
+```bash
+# 1. start the broker daemon (foreground)
+approval-hub serve
+
+# 2. in another terminal, attach the TUI
+approval-hub attach
+
+# 3. in any Claude Code session, install the plugin
+/plugin install kanywst-plugins/approval-hub
+/approval-hub:install
 ```
 
-## 進捗
+The plugin's PreToolUse hook now routes every permission prompt to the
+broker. The TUI shows them in one place; press `y` / `n` / `a`
+(allow + learn) / `d` (deny + learn) to resolve. Learned matchers
+follow Claude Code's permission rule syntax (`Bash(npm test:*)`) so they
+can be exported to `settings.json` later.
+
+## Commands
+
+- `approval-hub serve` — run the broker daemon in the foreground
+- `approval-hub attach` — open the TUI client
+- `approval-hub list` — list learned matcher rules
+- `approval-hub revoke <id>` — delete a learned rule
+- `approval-hub rotate` — rotate the bearer token
+- `approval-hub doctor` — diagnose the install
+
+## Architecture
+
+See [ARCHITECTURE.md](ARCHITECTURE.md) for the broker / TUI / plugin
+data flow and design rationale.
+
+## Security
+
+See [SECURITY.md](SECURITY.md) for the threat model and mitigations.
+
+## License
+
+MIT. See [LICENSE](LICENSE).
 
-着手前。詳細仕様調査 → 設計ドキュメント → 実装計画分解 → 実装の順で進める。
+[approval-hub plugin]: https://github.com/kanywst/claude-code-plugins/tree/main/plugins/approval-hub