v1.0.1

Documentation overhaul (TESTING/CONTRIBUTING/ARCHITECTURE/SECURITY/CLAUDE.md,
CHANGELOG.md, drop unmaintained src/README.md) plus CI-built Docker images:
Gitea Actions now builds and pushes the servicedesk image to the Gitea
container registry on Dockerfile changes, and compose.yaml pulls that image
instead of building locally. No application behavior changes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

TESTING.md

@@ -0,0 +1,64 @@
+# Testing
+
+Tests live in `src/tests/` and run on [Pest 4](https://pestphp.com) (with the Laravel
+plugin), backed by PHPUnit's runner. `src/phpunit.xml` configures two suites,
+`Unit` and `Feature` (almost everything lives in `Feature/` — end-to-end Livewire
+component and API tests), running against an in-memory SQLite database
+(`DB_CONNECTION=sqlite`, `DB_DATABASE=:memory:`) so tests never touch the real
+MariaDB instance. Mail, queue, cache, session and broadcasting are all swapped for
+fast in-process fakes (`array`/`sync`) for the same reason.
+
+## Running the suite
+
+From inside the app container (or on a bare-metal install, from `src/`):
+
+```bash
+docker compose exec servicedesk php artisan test
+```
+
+or directly with Pest:
+
+```bash
+docker compose exec servicedesk ./vendor/bin/pest
+```
+
+Run a single file or filter by name:
+
+```bash
+docker compose exec servicedesk php artisan test --filter=SlaBreachNotificationTest
+docker compose exec servicedesk ./vendor/bin/pest tests/Feature/TicketApiTest.php
+```
+
+There is no CI pipeline configured for this repository — running the suite
+locally/in-container before merging or deploying is the only gate today.
+
+## What's covered
+
+The `Feature/` suite is organized by area and is the main source of truth for
+expected behavior — read the relevant test before changing logic in that area:
+
+- **Admin**: category/subcategory + custom fields, teams, users, branding, status/
+  priority reordering, response templates, email templates & notification toggles,
+  SMTP/timezone/session-lifetime config.
+- **Operator**: ticket queue (search/sort/columns, bulk actions, closed tab, team
+  scoping), ticket detail editing, quick actions, time tracking.
+- **Client**: new ticket submission.
+- **Auth/LDAP**: LDAP login, LDAP-restricted guest ticket creation + local-account
+  fallback, account-creation toggles.
+- **API**: ability-scoped Sanctum enforcement (`ApiAbilityEnforcementTest`), API key
+  management, tickets/messages/users/dictionaries endpoints.
+- **Cross-cutting**: role middleware, SLA breach notifications, attachment limits,
+  ticket business rules (status/priority transitions, merging, history log).
+
+`tests/Pest.php` wires up `Tests\TestCase` (Laravel's `RefreshDatabase`-style base)
+for the whole suite — new test files under `tests/Feature/` pick this up
+automatically without extra boilerplate.
+
+## Code style
+
+`laravel/pint` is installed as a dev dependency (no custom `pint.json`, so it runs
+on Laravel's default preset). Run it before committing:
+
+```bash
+docker compose exec servicedesk ./vendor/bin/pint
+```