feat: prepare App X-Ray for service readiness

[flowylife]

Purpose

Prepare App X-Ray for open-source service readiness as a local-first planning tool: users can import source material, review AI-suggested structure, preserve confirmed decisions, recover local work, export confirmed artifacts, and rely on repository-level contribution and CI guardrails.

Changes

• Added service-readiness documentation, local-first data contracts, manual QA notes, and an English README.
• Added source import support, review workbench improvements, validation repair actions, deterministic exports, local recovery snapshots, BYOK AI provider adapters, and browser E2E coverage.
• Added open-source project files: MIT license, contributing guide, security policy, issue templates, PR template, and GitHub Actions CI.
• Improved mobile layout and extracted the workspace analysis runner out of the React shell.

Verification

• npm run lint - Not available; no lint script exists in package.json.
• npm run typecheck
• npm run test
• npm run build
• npm run test:e2e
• Browser/manual check completed

User Flow Checked

UI flow checked with Playwright manual runs on mobile and desktop:

• Page checked: App X-Ray home/new project flow at local Vite dev server.
• Action performed: created a project, entered source text, ran Mock analysis, and opened the review workbench.
• Observed result: review rows rendered, local save status appeared, and mobile viewport stayed within viewport width without horizontal overflow.
• Layout or interaction issues found: mobile horizontal overflow was found and fixed in this PR.

Automated E2E flows checked:

• Create project, import source, review suggestions, and export confirmed-only markdown.
• Persist projects across reload and switch projects.
• Block export download when confirmed relations reference unconfirmed data objects.
• Download workspace backup and import it into the current workspace.

Risk Areas

• DB schema changed: No
• API contract changed: No
• Auth/permission changed: No
• UI layout changed: Yes
• State management changed: Yes
• Data import/export changed: Yes
• Build/deployment config changed: Yes
• Test coverage changed: Yes

Files Changed

• README and docs: document service-readiness scope, local-first boundaries, QA, packaging decision, and public project usage.
• src/domain, src/storage, src/export, src/ai: add core readiness behavior for review lifecycle, validation, recovery, exports, and BYOK provider integration.
• src/components and src/App.tsx: improve review/export UI flows and move analysis orchestration into src/app/run-analysis.ts.
• test and test/e2e: add domain, UI, storage recovery, AI provider, export, and browser regression coverage.
• .github, LICENSE, CONTRIBUTING.md, SECURITY.md: add open-source project governance and CI.

Follow-up Issues

• Browser BYOK provider calls can still be blocked by provider CORS policy; mock mode remains the safe fallback.
• PDF import remains intentionally unsupported until a parser dependency is approved.
• App.tsx is smaller after extracting analysis execution, but further orchestration slices can still be separated later.

Merge Note

Do not merge this PR automatically. The user will review and decide whether to merge.