Merge open-source prep (MIT license + README) into develop

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dasnuve
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,5 +1,116 @@
-# frontend-helper
+# Minnect Feed Browser
 
-Minnect feed browser: sign in with your own Minnect account, then read and write the expert home feed. Tokens stay on the server.
+A small web client for the Minnect expert home feed. You run it on your own
+machine, sign in with **your own** Minnect email and password, and then read and
+write the feed as yourself — read posts, like, comment, and publish text, image,
+and video posts.
 
-See `CLAUDE.md` for the branching workflow and `docs/` for the requirements and ADRs.
+> **Unofficial.** This is an independent, community-built client. It is not
+> affiliated with, endorsed by, or supported by Minnect or Valuetainment. It
+> uses your own Minnect account credentials, which you provide, to talk to
+> Minnect's API on your behalf. Use it at your own discretion and in line with
+> Minnect's terms of service.
+
+## What it does
+
+- **Sign in with your own Minnect account.** Your tokens are kept on the local
+  server behind an httpOnly session cookie — they never reach the browser, the
+  JavaScript bundle, a URL, or a log line.
+- **One home feed, newest first,** with your own posts interleaved in their
+  correct time order (not all bunched at the top), infinite scroll, and a gentle
+  ~45s poll that offers new posts without yanking the page.
+- **Likes** — like and unlike, with the count kept in sync.
+- **Comments** — read a post's comments and add your own.
+- **Posts** — publish a public text post, or a post with one image or one video.
+  Uploads go through the local server, so your feed token never touches the
+  browser or the storage bucket.
+- **Delete** your own posts (and only your own).
+- Responsive — works on a phone-width window and on the desktop.
+
+## How it works
+
+```
+your browser  --cookie session-->  this app (localhost)  --Bearer token-->  Minnect
+```
+
+The browser only ever talks to this app. This app talks to Minnect server-side.
+That keeps your Minnect tokens off the browser entirely and avoids cross-origin
+restrictions. See `CLAUDE.md` and `docs/` (if present) for the design notes.
+
+## Requirements
+
+- Node.js 20 or newer (built and tested on Node 22).
+- A Minnect account (your own email and password).
+
+## Quickstart
+
+```bash
+git clone <this-repo-url> minnect-feed-browser
+cd minnect-feed-browser
+npm install
+npm run dev
+```
+
+Open <http://localhost:3000>, sign in with your own Minnect email and password,
+and you are in. A wrong password shows a single generic message and signs no one
+in.
+
+For a production-style local run instead of dev mode:
+
+```bash
+npm run build && npm start
+```
+
+## Configuration
+
+No configuration is required — the Minnect host URLs have sensible defaults. To
+override them (for example to point at a different environment), copy
+`.env.example` to `.env.local` (which is gitignored) and edit the values:
+
+```bash
+cp .env.example .env.local
+```
+
+| Variable            | Default                                  | What it is                                   |
+| ------------------- | ---------------------------------------- | -------------------------------------------- |
+| `PROFILES_BASE_URL` | `https://profiles.minnect.com`           | Sign-in, auth/me, refresh, revoke, feed token |
+| `FEED_BASE_URL`     | `https://feed.sharedservices.vt.com`     | Home feed, posts, likes, comments            |
+
+## Scripts
+
+| Command           | What it does                      |
+| ----------------- | --------------------------------- |
+| `npm run dev`     | Start the dev server              |
+| `npm run build`   | Production build                  |
+| `npm start`       | Run the production build          |
+| `npm test`        | Run the test suite (Vitest)       |
+| `npm run lint`    | Lint                              |
+| `npm run typecheck` | Type-check with `tsc`           |
+
+## Limitations (by design — this is a simple, local tool)
+
+- **Run it locally.** It is meant to run on your own machine over
+  `http://localhost`, for one person at a time.
+- **Sessions live in memory.** They are held in the running Node process, so
+  restarting the server signs you out. That is fine for local use.
+- **Not built for public or multi-instance hosting as-is.** The in-memory
+  session store does not work across multiple server instances or serverless
+  functions, and the session cookie is `Secure` (so a public deployment needs
+  HTTPS). Hosting it for real would mean swapping the store in
+  `src/lib/session-store.ts` for a shared one (e.g. Redis) and serving over TLS.
+- **No admin features.** By design it only touches the regular user feed — no
+  admin routes, no shared account, no ticketing, wallet, circles, or paid
+  questions.
+
+## Security notes
+
+- Your credentials are sent only to your own local server, which exchanges them
+  with Minnect and keeps the resulting tokens server-side. The browser receives
+  only an opaque session id in an httpOnly cookie.
+- A build of the frontend contains no tokens or passwords.
+- Because it runs locally and holds your live session, treat the machine you run
+  it on as you would any signed-in session.
+
+## License
+
+MIT — see [LICENSE](LICENSE).