v1.0.1

Documentation overhaul (TESTING/CONTRIBUTING/ARCHITECTURE/SECURITY/CLAUDE.md,
CHANGELOG.md, drop unmaintained src/README.md) plus CI-built Docker images:
Gitea Actions now builds and pushes the servicedesk image to the Gitea
container registry on Dockerfile changes, and compose.yaml pulls that image
instead of building locally. No application behavior changes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

SECURITY.md

@@ -0,0 +1,54 @@
+# Security Policy
+
+This is an internally-run production helpdesk (not an open-source project with a
+public disclosure program). If you find a vulnerability affecting this
+deployment, report it directly rather than opening a public GitHub issue:
+
+- **Contact**: the address configured as `AUTHOR_CONTACT` in `src/.env`
+  (surfaced in the app under Admin > O aplikacji).
+- Please include steps to reproduce and, if applicable, which role/area
+  (Client/Operator/Admin/API) is affected.
+
+Do not test against the production instance beyond what's needed to demonstrate
+the issue — no automated scanning, load testing, or bulk data extraction.
+
+## Scope & sensitive data
+
+This system holds real ticket content, user PII (names/emails, and anything
+submitted in ticket bodies/custom fields), and LDAP/SMTP connection credentials.
+Treat access to the `admin` area, the `settings` table, and any `.env` file as
+credential-equivalent.
+
+## Notable design points relevant to security review
+
+- **Auth**: LDAP bind is the primary login path (`config/auth.php`,
+  `directorytree/ldaprecord-laravel`); a local fallback account
+  (`admin@example.com`, seeded — **must** have its password changed after
+  install, see [install.md](install.md)) exists for when LDAP is unavailable or
+  misconfigured.
+- **Settings override**: Admin > Konfiguracja values in the `settings` table
+  override `.env` for LDAP/SMTP/session/timezone config at runtime (see
+  [ARCHITECTURE.md](ARCHITECTURE.md) — "Settings override"). This means a
+  compromised admin account can redirect LDAP/SMTP traffic without touching the
+  filesystem — restrict Admin-role accounts accordingly.
+- **API**: Sanctum tokens are ability-scoped (`tickets:read`, `tickets:write`,
+  `dictionaries:read`, `users:read`) and issued per `ApiClient` via the admin
+  panel; rate-limited per-client (authenticated) or per-IP (unauthenticated) —
+  see `AppServiceProvider::configureApiRateLimiting()`.
+- **Role model**: roles are checked via `EnsureRole` middleware against
+  `$user->roles`; there's no per-object ACL beyond team-based ticket visibility
+  (`Ticket::scopeVisibleToOperator`) — any change to that scope directly changes
+  what an operator can see across teams.
+- **Attachments**: size/count/type limits are admin-configurable
+  (`attachment_max_size_kb`, `attachment_allowed_types`, etc. in `Settings`) —
+  don't bypass them when adding new upload paths.
+- **TLS**: production traffic terminates at Traefik with a private CA
+  certificate (not publicly trusted) — this is expected for this deployment, not
+  a misconfiguration.
+
+## Dependencies
+
+No automated dependency-vulnerability scanning (e.g. Dependabot, `composer
+audit` in CI) is currently configured — there is no CI pipeline for this repo at
+all (see [TESTING.md](TESTING.md)). Run `composer audit` / `npm audit` manually
+before major dependency bumps.