chore: prepare repository for open-source release

- License the product under AGPL-3.0-or-later and the reusable libraries
  under Apache-2.0; add per-package LICENSE files, license fields, and a
  check-license-metadata pre-commit gate
- Add a CLA and community-health docs (Code of Conduct, Contributing,
  Security, Support, CODEOWNERS, issue/PR templates, funding, trademark)
- Add supply-chain and CI automation (Dependency Review, OpenSSF Scorecard,
  link checker, Dependabot auto-merge, gitleaks allowlist)
- Tighten the legal pages: DPO, Art. 22, hosting and transfer disclosures,
  a dynamic email-provider disclosure, and a single-source privacy TOC
- Require Terms and Privacy acceptance on sign-up

Author: Medformatik

.github/CODEOWNERS

@@ -0,0 +1,16 @@
+# Code owners for OpenMapX.
+# These owners are automatically requested for review on matching pull requests.
+# See https://docs.github.com/repositories/managing-your-repositories-permissions/about-code-owners
+#
+# More specific rules below override earlier ones for a given path.
+
+# Default owner for everything in the repo.
+*                       @Medformatik
+
+# Governance / legal / community-health files warrant extra care.
+/LICENSE                @Medformatik
+/LICENSING.md           @Medformatik
+/CLA.md                 @Medformatik
+/CODE_OF_CONDUCT.md     @Medformatik
+/SECURITY.md            @Medformatik
+/.github/               @Medformatik

.github/FUNDING.yml

@@ -0,0 +1,16 @@
+# Funding links shown on the repo's "Sponsor" button.
+# https://docs.github.com/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
+#
+# Each key maps to one platform; values are your account/slug there. A button
+# only appears for platforms you've actually set up, so unused keys can stay
+# commented out. `github` requires GitHub Sponsors to be enabled for the account.
+
+github: [Medformatik]
+# patreon: openmapx
+# open_collective: openmapx
+# ko_fi: openmapx
+# liberapay: openmapx
+# buy_me_a_coffee: openmapx
+# tidelift: npm/@openmapx/core
+# polar: openmapx
+# custom: ["https://openmapx.org/donate"]

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,57 +1,109 @@
-name: Bug report
+name: 🐛 Bug report
 description: Report a defect in OpenMapX
+title: "[Bug]: "
 labels: [bug, needs-triage]
 body:
   - type: markdown
     attributes:
       value: |
-        Thanks for the report. Please fill out as much as you can — incomplete reports get bounced.
-        For security issues, do **not** file a public issue; see [SECURITY.md](../blob/main/SECURITY.md).
+        Thanks for taking the time to file a bug. Please fill out as much as you can —
+        incomplete reports are slower to act on and may be closed.
+
+        - 🔒 **Security issue?** Do **not** file it here — see [SECURITY.md](https://github.com/OpenMapX/openmapx/blob/main/SECURITY.md).
+        - ❓ **Question or idea?** Please use [Discussions](https://github.com/OpenMapX/openmapx/discussions) instead.
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Before you start
+      options:
+        - label: I searched [existing issues](https://github.com/OpenMapX/openmapx/issues?q=is%3Aissue) and this isn't a duplicate.
+          required: true
+        - label: I'm on the latest `main` or the most recent release (older versions aren't patched).
+          required: true
+        - label: This is a bug in OpenMapX itself, not in an upstream service (Valhalla, Nominatim, MOTIS, …) or a third-party API.
+          required: true
   - type: textarea
     id: what-happened
     attributes:
       label: What happened?
-      description: What did you do, what did you expect, what did you observe?
+      description: A clear, concise description of the bug — what you expected and what actually occurred.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
       placeholder: |
-        Steps:
-        1.
-        2.
-        3.
-        Expected:
-        Actual:
+        1. Go to '...'
+        2. Search for '...' / enable service '...' / run `openmapx ...`
+        3. See error
     validations:
       required: true
-  - type: input
+  - type: dropdown
+    id: where
+    attributes:
+      label: Where does it happen?
+      options:
+        - Self-hosted deployment (Docker Compose)
+        - Local development (`pnpm dev`)
+        - Hosted app (openmapx.com)
+        - Not sure
+    validations:
+      required: true
+  - type: dropdown
     id: component
     attributes:
-      label: Affected component
-      description: Which app, service, integration, or CLI command?
-      placeholder: "apps/web, integrations/transit-hafas, packages/cli `openmapx services up`, ..."
+      label: Affected area
+      description: Which part of OpenMapX? Pick the closest.
+      options:
+        - Web app (apps/web)
+        - API gateway (apps/api)
+        - Admin panel
+        - A specific integration (integrations/*)
+        - A specific service / container (services/*)
+        - CLI (`openmapx`)
+        - Data pipeline (data-manager / MOTIS / Transitous)
+        - Documentation
+        - Other / not sure
     validations:
       required: true
+  - type: input
+    id: component-id
+    attributes:
+      label: Specific integration / service id
+      description: If the area above is an integration or service, name it.
+      placeholder: "integrations/transit-hafas, services/valhalla, …"
   - type: input
     id: version
     attributes:
       label: Version / commit
       description: Tag, release, or short SHA from `git rev-parse --short HEAD`.
     validations:
       required: true
+  - type: input
+    id: last-working
+    attributes:
+      label: Last working version
+      description: If this used to work, the last version/commit where it did (helps us bisect). Leave blank if unknown.
   - type: textarea
     id: environment
     attributes:
       label: Environment
-      description: OS, Node version, pnpm version, browser (if web), Docker version (if self-hosted), which services / integrations enabled.
+      description: Required for self-hosted and local-dev reports. You can skip it for the hosted app.
       placeholder: |
         OS: macOS 15.0 / Ubuntu 24.04
         Node: 24.x
         pnpm: 11.x
-        Browser: Chrome 132
-        Services enabled: postgis, martin, valhalla, ...
-    validations:
-      required: true
+        Browser: Chrome 132 (if a web issue)
+        Docker: 27.x (if self-hosted)
+        Services enabled: postgis, martin, valhalla, motis, …
+        Integrations enabled: geocoding-photon, routing-valhalla, …
+      render: text
   - type: textarea
     id: logs
     attributes:
-      label: Logs / screenshots
-      description: Paste any relevant log output (redact secrets) or attach screenshots.
+      label: Relevant logs and/or screenshots
+      description: |
+        Paste relevant log output (`openmapx logs <service>`, browser console, API errors) or attach screenshots.
+        **Redact secrets, tokens, and `.env` values.**
       render: shell

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,11 @@
 blank_issues_enabled: false
 contact_links:
-  - name: Security vulnerability
-    url: https://github.com/OpenMapX/openmapx/security/advisories/new
-    about: Please report security issues privately via a draft GitHub Security Advisory. See SECURITY.md for the full process.
-  - name: Question or discussion
+  - name: 📚 Documentation
+    url: https://docs.openmapx.org
+    about: Setup, self-hosting, CLI, and architecture guides — please check here first.
+  - name: 💬 Question or discussion
     url: https://github.com/OpenMapX/openmapx/discussions
     about: For usage questions, integration ideas, and general discussion, please use Discussions instead of opening an issue.
+  - name: 🔒 Security vulnerability
+    url: https://github.com/OpenMapX/openmapx/security/advisories/new
+    about: Report security issues privately via a draft GitHub Security Advisory. See SECURITY.md for the full process.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,47 +1,67 @@
-name: Feature request
-description: Suggest a new feature, integration, or service
+name: ✨ Feature request
+description: Suggest a new capability or improvement
+title: "[Feature]: "
 labels: [enhancement, needs-triage]
 body:
   - type: markdown
     attributes:
       value: |
-        Thanks for the idea. If you plan to implement it yourself, please open the issue first so we can agree on the approach before you write code.
+        Thanks for the idea! A few pointers first:
+
+        - 🧩 **Requesting a new data provider** (geocoder, router, transit feed, weather, POI source)?
+          Use the **🧩 New integration / provider** template instead — it asks the right questions.
+        - 💬 Not sure yet, or want to gauge interest? Float it in
+          [Discussions](https://github.com/OpenMapX/openmapx/discussions) first.
+        - 🛠️ Planning to implement it yourself? Please open this issue **before** writing code so we can
+          agree on the approach.
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Before you start
+      options:
+        - label: I searched existing issues and discussions and this isn't already proposed.
+          required: true
   - type: textarea
     id: problem
     attributes:
-      label: Problem
-      description: What user need or pain point does this address? Who is the user?
+      label: What problem does this solve?
+      description: The user need or pain point. Who hits it, and when?
+      placeholder: "As a self-hoster / end user, I want … so that …"
     validations:
       required: true
   - type: textarea
     id: proposal
     attributes:
       label: Proposed solution
-      description: What should OpenMapX do? Be concrete — UI, API, manifest field, CLI flag, etc.
+      description: What should OpenMapX do? Be concrete — UI, API shape, manifest field, CLI flag, etc.
     validations:
       required: true
   - type: textarea
     id: alternatives
     attributes:
       label: Alternatives considered
-      description: Other approaches you weighed and why you rejected them.
+      description: Other approaches you weighed and why you set them aside.
   - type: dropdown
     id: scope
     attributes:
-      label: Scope
+      label: Area
       options:
-        - New integration (`integrations/<id>/`)
-        - New service (`services/<slug>/`)
-        - Web UI change
-        - API change
-        - CLI change
-        - Docs only
+        - Web UI
+        - API
+        - CLI / self-hosting workflow
+        - Admin panel
+        - Data pipeline (data-manager / MOTIS / Transitous)
+        - Documentation
         - Other / cross-cutting
     validations:
       required: true
-  - type: checkboxes
+  - type: dropdown
     id: contribution
     attributes:
-      label: Contribution
+      label: Would you like to work on this?
       options:
-        - label: I'm willing to send a PR for this.
+        - "Yes — I'd like to open a PR"
+        - "Maybe, with some guidance"
+        - "No — just suggesting"
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/integration_request.yml

@@ -0,0 +1,99 @@
+name: 🧩 New integration / provider
+description: Request (or propose to build) support for a new data provider, source, or backend service
+title: "[Integration]: "
+labels: [enhancement, integration, needs-triage]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        OpenMapX integrates data providers (geocoders, routers, transit feeds, weather, POI
+        sources, reviews, photos, …) and backend services. Use this form to request one, or to
+        propose building it yourself.
+
+        Helpful background: [Integration system](https://docs.openmapx.org/developer/integration-system/)
+        · [Writing an integration](https://docs.openmapx.org/developer/writing-an-integration/).
+  - type: input
+    id: provider-name
+    attributes:
+      label: Provider / source name
+      placeholder: "e.g. Stadia Maps, GTFS feed for SNCF, Overpass, OpenWeatherMap"
+    validations:
+      required: true
+  - type: input
+    id: provider-url
+    attributes:
+      label: Provider website
+      placeholder: "https://…"
+    validations:
+      required: true
+  - type: dropdown
+    id: domain
+    attributes:
+      label: Domain
+      description: What kind of data or capability does it provide?
+      multiple: true
+      options:
+        - Geocoding / search
+        - Routing / directions
+        - Public transit (transit / live-transit)
+        - Mobility (bike / car / scooter sharing, parking, fuel)
+        - Weather / air quality
+        - POI / places
+        - Map overlay (raster/vector layer)
+        - Photos / street-level imagery
+        - Reviews
+        - Knowledge / enrichment
+        - A backend service / container (services/*)
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: api-docs
+    attributes:
+      label: API / data documentation
+      description: Link to the API reference, GTFS feed, or data format docs.
+      placeholder: "https://…"
+  - type: dropdown
+    id: auth
+    attributes:
+      label: Access requirements
+      options:
+        - Fully open — no key required
+        - Free API key required
+        - Paid / metered API key required
+        - Self-hosted backend (runs as a service container)
+        - Unknown
+    validations:
+      required: true
+  - type: input
+    id: coverage
+    attributes:
+      label: Geographic coverage
+      description: Global, or specific countries / regions?
+      placeholder: "e.g. Global, Germany only, Nordic countries"
+  - type: textarea
+    id: licensing
+    attributes:
+      label: Data license & attribution terms
+      description: |
+        **Important.** OpenMapX is built on open data and tracks attribution per source. What license
+        or terms of use govern the data, and what attribution does it require? Link the terms if you can.
+      placeholder: "e.g. ODbL (requires '© OpenStreetMap contributors'), CC-BY-4.0, proprietary ToS at …"
+    validations:
+      required: true
+  - type: input
+    id: existing-service
+    attributes:
+      label: Maps to an existing service?
+      description: If this provider is served by a backend already in `services/` (e.g. Valhalla, Pelias, MOTIS), name it.
+      placeholder: "services/valhalla"
+  - type: dropdown
+    id: contribution
+    attributes:
+      label: Would you like to build it?
+      options:
+        - "Yes — I'd like to open a PR"
+        - "Maybe, with some guidance"
+        - "No — just requesting"
+    validations:
+      required: true