Prepare Signal Forge for public portfolio release

[AFR0011]

Summary

Prepare the maintained backend application for portfolio publication under the Signal Forge identity, with its security model, concurrency limits, deployment assumptions, and media-processing boundary documented.

Completed

• rewrote the README around isolated jobs, ownership-scoped access, atomic resource admission, bounded concurrency, path confinement, Socket.IO progress, cleanup/recovery, and failure handling
• retained the legal-use disclaimer and explicit non-affiliation with Spotify, YouTube, Apple, and other media platforms
• added a Mermaid architecture diagram and engineering summary
• added SECURITY.md covering secrets, ownership boundaries, process-local state, deployment constraints, and responsible reporting
• added PUBLICATION.md with project scope, current boundaries, and a clean-history publication strategy
• added a safe .env.example with no usable secret
• added tools/publication_guard.py to enforce release invariants and block committed media/ZIP artifacts
• added GitHub Actions CI on Python 3.14.6 with pip-audit, Python syntax validation, JavaScript syntax validation, and pytest
• retained the Apache-2.0 license

Verification

• publication guard: pass
• dependency installation on Python 3.14.6: pass
• pip-audit: pass — no known vulnerabilities found
• Python syntax scan: pass
• JavaScript syntax scan: pass
• pytest: pass — 58 tests

Current boundaries

• the implementation uses yt-dlp as the media adapter
• the process-local registry requires exactly one application worker
• browser-session possession is the ownership boundary; durable account-based multi-tenant storage is not implemented
• source matching is heuristic and may select a different recording from the intended one

Release path

The legacy history contains obsolete 2024-era browser-automation experiments that are unrelated to the maintained application. For the public portfolio, keep this repository as the private development archive and publish the maintained Signal Forge tree in a clean signal-forge repository with fresh history.

Use synthetic/demo data in public screenshots.