chore: cleanup repository for public presentation

- Fix CI: cargo fmt, clippy dead_code warnings, cargo-audit ignores
- Add .cargo/audit.toml with documented security advisory ignores
- Revise README.md: badges, concise overview, edgy tagline
- Remove internal qa-analysis.md documentation
- Configure GitHub repo: description, topics, branch protection, wiki disabled

Author: mfw78

.cargo/audit.toml

@@ -0,0 +1,24 @@
+# Security audit configuration
+# See https://rustsec.org for advisory details
+
+[advisories]
+# Advisories to ignore - all are transitive dependencies with no available fix
+ignore = [
+    # rsa timing attack - transitive via sqlx-mysql (compile-time query checking)
+    # We use PostgreSQL, not MySQL, so this doesn't affect runtime security
+    # https://rustsec.org/advisories/RUSTSEC-2023-0071
+    "RUSTSEC-2023-0071",
+
+    # tokio-tar PAX header parsing - only used by testcontainers (dev dependency)
+    # Not present in production builds
+    # https://rustsec.org/advisories/RUSTSEC-2025-0111
+    "RUSTSEC-2025-0111",
+
+    # rustls-pemfile unmaintained - transitive via bollard
+    # No alternative available yet, watching for updates
+    # https://rustsec.org/advisories/RUSTSEC-2025-0134
+    "RUSTSEC-2025-0134",
+]
+
+# Don't fail on informational advisories (unmaintained, unsound, etc.)
+informational_warnings = []

README.md

@@ -1,155 +1,46 @@
 # Catapult
 
-Automated deployment runner for GitHub webhooks. Handles PR preview deployments and main branch deployments with Nix-based build isolation and multi-environment support.
+[![CI](https://github.com/nullisLabs/catapult/actions/workflows/ci.yml/badge.svg)](https://github.com/nullisLabs/catapult/actions/workflows/ci.yml)
+[![License: AGPL-3.0](https://img.shields.io/badge/License-AGPL--3.0-blue.svg)](https://www.gnu.org/licenses/agpl-3.0)
+[![Rust](https://img.shields.io/badge/rust-1.75%2B-orange.svg)](https://www.rust-lang.org)
+[![NixOS](https://img.shields.io/badge/NixOS-ready-5277C3.svg)](https://nixos.org)
 
-## Architecture Overview
+Preview deploys without the Vercel price tag. Nix builds, your servers, zero BS.
+
+## Overview
 
 Catapult uses a **central + worker** architecture:
 
+- **Central** receives GitHub webhooks, manages configuration, and dispatches jobs
+- **Workers** execute builds in isolated Podman containers and deploy to Caddy
+
 ```
-GitHub App (single application)
-    ↓ webhooks
-┌─────────────────────────────────────────────────────────────┐
-│ Catapult Central (catapult.nullislabs.io)                   │
-│   ├─ Receives all GitHub webhooks                           │
-│   ├─ Verifies webhook signatures                            │
-│   ├─ Looks up deployment config (PostgreSQL)                │
-│   ├─ Generates GitHub installation access tokens            │
-│   ├─ Posts "Building..." comment to PR                      │
-│   └─ Dispatches build jobs to appropriate worker            │
-└─────────────────────────────────────────────────────────────┘
-                    ↓ authenticated job dispatch
-    ┌───────────────┴───────────────┐
-    ↓                               ↓
-┌─────────────────────────┐ ┌─────────────────────────┐
-│ Caddy Container         │ │ Caddy Container         │
-│ (nullislabs)            │ │ (nullispl)              │
-│ ┌─────────────────────┐ │ │ ┌─────────────────────┐ │
-│ │ Catapult Worker     │ │ │ │ Catapult Worker     │ │
-│ │ deployer.nullislabs │ │ │ │ deployer.nullis.pl  │ │
-│ │ .io                 │ │ │ │                     │ │
-│ │ - Clones repo       │ │ │ │ - Clones repo       │ │
-│ │ - Builds (Podman)   │ │ │ │ - Builds (Podman)   │ │
-│ │ - Deploys files     │ │ │ │ - Deploys files     │ │
-│ │ - Configures Caddy  │ │ │ │ - Configures Caddy  │ │
-│ └─────────────────────┘ │ │ └─────────────────────┘ │
-│ Caddy Server            │ │ Caddy Server            │
-└─────────────────────────┘ └─────────────────────────┘
-                    ↓ status updates
-┌─────────────────────────────────────────────────────────────┐
-│ Catapult Central                                            │
-│   └─ Posts success/failure comment to PR                    │
-└─────────────────────────────────────────────────────────────┘
+GitHub ──webhook──▶ Central ──dispatch──▶ Worker ──deploy──▶ Caddy
+                       │                     │
+                       ▼                     ▼
+                   PostgreSQL            Podman + Nix
 ```
 
-## Components
-
-### Catapult Central (`catapult.nullislabs.io`)
-
-The orchestrator that handles GitHub integration:
-
-- Receives webhooks from the GitHub App
-- Verifies webhook signatures
-- Manages deployment configuration database
-- Generates short-lived GitHub installation tokens
-- Dispatches jobs to environment-specific workers
-- Posts PR comments (building, success, failure)
-
-### Catapult Worker (`deployer.<zone>`)
-
-Runs inside each Caddy container, executes builds and deployments:
-
-- Receives authenticated build jobs from Central
-- Clones repositories (using provided GitHub token)
-- Runs builds in isolated Podman containers (NixOS-based)
-- Writes build artifacts to `/var/www/sites/`
-- Configures Caddy routes via admin API (localhost:2019)
-- Reports status back to Central
-
-**Single binary, two modes:**
+Single binary, two modes:
 ```bash
 catapult central   # Run as orchestrator
 catapult worker    # Run as build executor
 ```
 
-## Key Features
-
-- **Single GitHub App** - One app installation covers all environments
-- **Multi-environment support** - Deploy to different Caddy instances
-- **Private repository support** - Uses GitHub App installation access tokens
-- **PR preview deployments** - Automatic previews for every PR
-- **Main branch deployments** - Automatic production deployments
-- **Automatic cleanup** - Removes PR deployments on merge/close
-- **Nix-based build isolation** - Podman containers with flake-defined environments
-- **Custom build commands** - Via `.deploy.json` in repository
-
-## Build System
-
-Workers use **Podman** to run isolated build containers. Each container runs a minimal NixOS image that uses **Nix flakes** to bring up the appropriate build environment.
-
-```
-Catapult Worker (deployer.<zone>)
-  ↓
-Podman (container-in-container)
-  ↓
-NixOS Container
-  ├─ nix develop (from build flake)
-  ├─ git clone (with token)
-  ├─ Run build command
-  └─ Output artifacts → /var/www/sites/
-```
-
-### Build Flakes
-
-| Type | Flake | Provides |
-|------|-------|----------|
-| `sveltekit` | `github:nullisLabs/catapult#sveltekit` | Node.js, npm |
-| `vite` | `github:nullisLabs/catapult#vite` | Node.js, npm |
-| `zola` | `github:nullisLabs/catapult#zola` | Zola static site generator |
-| `custom` | (from repo's flake.nix) | User-defined |
-| `auto` | (detected) | Based on repo contents |
-
-## Configuration
-
-### Central Environment Variables
-
-```bash
-# Database
-DATABASE_URL=postgresql://user:pass@host:5432/dbname
-
-# GitHub App
-GITHUB_APP_ID=123456
-GITHUB_PRIVATE_KEY_PATH=/path/to/private-key.pem
-GITHUB_WEBHOOK_SECRET=your-webhook-secret
-
-# Server
-LISTEN_ADDR=0.0.0.0:8080
-
-# Worker authentication
-WORKER_SHARED_SECRET=your-shared-secret
-```
-
-### Worker Environment Variables
+## Features
 
-```bash
-# Central connection
-CENTRAL_URL=https://catapult.nullislabs.io
-WORKER_SHARED_SECRET=your-shared-secret
+- **PR Preview Deployments** - Automatic previews at `pr-{N}-{repo}.example.com`
+- **Production Deployments** - Deploy on push to main branch
+- **Multi-tenant** - Route deployments to different workers by zone
+- **Nix Build Isolation** - Reproducible builds in Podman containers
+- **GitHub App Integration** - Private repo support, PR comments
+- **Cloudflare Tunnel Support** - Optional DNS and tunnel management
 
-# Server
-LISTEN_ADDR=0.0.0.0:8080
+## Quick Start
 
-# Build system
-PODMAN_SOCKET=/run/podman/podman.sock
+### Repository Configuration
 
-# Caddy
-CADDY_ADMIN_API=http://localhost:2019
-SITES_DIR=/var/www/sites
-```
-
-## Repository Configuration
-
-Repositories can include a `.deploy.json` file:
+Add `.deploy.json` to your repository:
 
 ```json
 {
@@ -159,72 +50,69 @@ Repositories can include a `.deploy.json` file:
 }
 ```
 
-### Build Types
-
-| Type | Default Command | Output Dir |
-|------|-----------------|------------|
-| `sveltekit` | `npm run build` | `build` |
-| `vite` | `npm run build` | `dist` |
-| `zola` | `zola build` | `public` |
-| `custom` | (from config) | (from config) |
-| `auto` | (detected) | (detected) |
+Supported build types: `sveltekit`, `vite`, `zola`, `custom`, `auto`
 
-## URL Structure
-
-### PR Deployments
-```
-https://pr-{number}-{repo}.{domain}/
+### Organization Defaults
 
-Examples:
-https://pr-42-website.wilmen.co/
-https://pr-123-docs.nullis.xyz/
-```
+Add `.deploy.json` to `{org}/.github/` for organization-wide defaults:
 
-### Main Branch Deployments
-```
-https://{subdomain}.{domain}/
-or
-https://{domain}/
+```json
+{
+  "zone": "production",
+  "domain_pattern": "{repo}.example.com",
+  "pr_pattern": "pr-{pr}-{repo}.example.com"
+}
 ```
 
-## Security
-
-### GitHub App Permissions
+## Deployment
 
-- Contents: Read (clone repos)
-- Pull Requests: Read & Write (comment on PRs)
+See [docs/deployment.md](docs/deployment.md) for NixOS deployment instructions.
 
-### Central ↔ Worker Authentication
+### NixOS Flake
 
-Workers authenticate with Central using a shared secret (HMAC-signed requests).
+```nix
+{
+  inputs.catapult.url = "github:nullisLabs/catapult";
+
+  outputs = { self, nixpkgs, catapult, ... }: {
+    nixosConfigurations.myserver = nixpkgs.lib.nixosSystem {
+      modules = [
+        catapult.nixosModules.default
+        {
+          services.catapult.central = {
+            enable = true;
+            databaseUrl = "postgresql://catapult@localhost/catapult";
+            githubAppId = 123456;
+            # ... see docs/deployment.md for full options
+          };
+        }
+      ];
+    };
+  };
+}
+```
 
-### Build Isolation
+## Architecture
 
-Builds run in isolated Podman containers with:
-- NixOS-based minimal image
-- Read-only root filesystem (except build directory)
-- Network restrictions (blocks RFC1918, allows internet)
-- Memory/CPU limits
-- PID limits (prevent fork bombs)
-- Dropped capabilities
+See [docs/architecture.md](docs/architecture.md) for detailed diagrams and API documentation.
 
 ## Development
 
 ```bash
 # Enter development environment
 nix develop
 
-# Run central
-cargo run -- central
-
-# Run worker
-cargo run -- worker
+# Build
+cargo build
 
 # Run tests
 cargo test
 
 # Watch mode
 cargo watch -x "run -- central"
+
+# Run all CI checks
+just ci
 ```
 
 ## License