Prepare samebase/app for public release

[nicu-chiciuc]

Why

samebase/app is close to public beta. Its README duplicated the hosted setup guide, and the repository had no public license, security policy, third-party notice, or CI. A review also found a critical Auth.js advisory in the starter dependency graph.

What changed

• Replaced the landing-style README with repository-focused local, check, build, deployment, generated-file, and history guidance.
• Linked the complete provider setup to the hosted Samebase do-it-yourself guide.
• Added Apache-2.0 licensing, a security policy, and Convex and Heroicons third-party notices.
• Removed four README-only provider logo assets.
• Defined normal append-only maintenance after the curated initial construction history.
• Added cross-platform automation guidance and incorporated the useful part of Document native cross-platform TypeScript automation #22.
• Updated Auth.js, Convex Auth, TanStack Start, shadcn, and Wrangler. Moved the shadcn CLI to development dependencies.
• Added safe in-range overrides for patched js-yaml and postcss releases.
• Added pinned GitHub Actions for signature checks, dependency audits, and the real Cloudflare build path.

Convex file licensing

The installed Convex AI files and skills are byte-identical to the Apache-2.0 licensed get-convex/templates snapshot linked in THIRD_PARTY_NOTICES.md. The Heroicons MIT notice is included.

Security result

• The critical @auth/core advisory GHSA-7rqj-j65f-68wh is fixed.
• pnpm audit --prod reports no known production vulnerabilities.
• The current upstream Wrangler and shadcn graphs still report one high and five moderate development-tool advisories. CI rejects any critical development-tool advisory without replacing exact upstream dependencies with unsupported versions.
• All 746 installed package signatures verify.

Validation

• vp run check
• pnpm audit --prod
• pnpm audit --dev --audit-level=critical
• pnpm audit signatures
• CLOUDFLARE_WORKER_NAME=samebase-app-readiness vp run deploy:dry-run
• CLOUDFLARE_WORKER_NAME=samebase-app-readiness vp run deploy:preview:dry-run

Both Wrangler dry-runs completed without publishing.

Follow-up outside this PR

Resolve #25, close #22 after this replacement lands, clean old remote branches, enable public security settings, and change visibility only after those steps.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}