v1.0.1

Documentation overhaul (TESTING/CONTRIBUTING/ARCHITECTURE/SECURITY/CLAUDE.md,
CHANGELOG.md, drop unmaintained src/README.md) plus CI-built Docker images:
Gitea Actions now builds and pushes the servicedesk image to the Gitea
container registry on Dockerfile changes, and compose.yaml pulls that image
instead of building locally. No application behavior changes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

compose.yaml.example

@@ -0,0 +1,50 @@
+# Copy to compose.yaml (gitignored — the real file stays untracked, same as .env)
+# and adjust HOSTNAME/image/registry as needed for your deployment.
+services:
+  servicedesk:
+    image: gitea.kzbikowski.pl/kzbkowski/servicedesk:${IMAGE_TAG:-latest}
+    volumes:
+      - ./src:/var/www/html
+    restart: unless-stopped
+    depends_on:
+      mariadb:
+        condition: service_healthy
+    networks:
+      - internal
+      - traefik_public
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik_public
+      - traefik.http.routers.servicedesk.rule=Host(`${HOSTNAME}`)
+      - traefik.http.routers.servicedesk.entrypoints=websecure
+      # - traefik.http.routers.servicedesk.tls.certresolver=tls-resolver
+      - traefik.http.routers.servicedesk.tls=true
+
+  mariadb:
+    image: mariadb:12.3
+    restart: unless-stopped
+    networks:
+      - internal
+    command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
+    volumes:
+      - ./mysql:/var/lib/mysql
+    ports:
+      - "3605:3306"
+    environment:
+      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
+      - MYSQL_DATABASE=${MYSQL_DATABASE}
+      - MYSQL_USER=${MYSQL_USER}
+      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    labels:
+      - com.centurylinklabs.watchtower.enable=true
+
+networks:
+  internal:
+  traefik_public:
+    external: true