Make the repo public-ready: English docs/UI, MIT license, README overhaul

.gitignore

@@ -30,6 +30,9 @@ go.work.sum
 .idea/
 .vscode/
 
+# Tooling scratch (Playwright MCP traces/console logs)
+.playwright-mcp/
+
 # OS / editor noise
 .DS_Store
 ._*

CONTRIBUTING.md

@@ -0,0 +1,103 @@
+# Contributing to subgen
+
+Thanks for your interest in subgen! This guide covers the dev setup, how to run the
+checks, code generation, and the project conventions.
+
+## Prerequisites
+
+- **Go 1.25+**
+- **Docker** — only for the black-box API tests (`apitest`), which spin up real 3x-ui panels.
+- A 3x-ui panel is **not** required for local development: the admin UI and the routing
+  builder work against an empty store; you only need a panel to provision real users.
+
+## Local setup
+
+```sh
+cp .env.example .env           # set SUBGEN_SECRET (openssl rand -hex 32) and SUBGEN_ADMIN_PASSWORD
+                               # leave SUBGEN_TLS_* empty → plain HTTP
+go run ./cmd/service           # http://127.0.0.1:2097/admin
+```
+
+For live frontend edits (no Go rebuild on CSS/JS changes), set in `.env`:
+
+```sh
+SUBGEN_STATIC_DIR=internal/handlers/web/static
+```
+
+## Tests, lint, codegen
+
+A `Makefile` wraps the common tasks:
+
+```sh
+make generate     # go generate ./...  (mockgen + ogen)
+make lint         # golangci-lint
+make test         # unit tests (go test ./...)
+make integration  # integration tests (-tags integration)
+make apitest      # black-box API tests against real 3x-ui in Docker
+make all          # generate + lint + test + integration + apitest
+```
+
+Or directly:
+
+```sh
+go test ./...                     # unit
+go test -tags integration ./...   # integration (real SQLite)
+go generate ./...                 # regenerate mocks + ogen server
+go generate ./internal/oas/       # regenerate just the ogen server from openapi/
+```
+
+CI (`.github/workflows/ci.yml`) runs lint + unit + integration + apitest on every PR; all
+must be green.
+
+## Code generation
+
+- **HTTP layer** is generated by [ogen](https://github.com/ogen-go/ogen) from the OpenAPI
+  spec. To add or change an endpoint: edit `openapi/<endpoint>.yaml` (+ a `$ref` in
+  `openapi/openapi.yaml`), run `go generate ./internal/oas/`, then implement the handler
+  against the generated interface. **Do not register routes by hand.**
+- **Mocks** are generated by [mockgen](https://github.com/uber-go/mock) from each package's
+  `contract.go`. After changing a `contract.go`, run `go generate ./...`.
+
+Commit the regenerated code together with your change.
+
+## Conventions
+
+Read **[`AGENTS.md`](AGENTS.md)** — it is the canonical style guide (layering, `contract.go`
++ mockgen dependencies, table-driven tests, sentinel errors, per-handler error
+classification, the mihomo-config subdomain, migrations). New code follows it; when you
+touch old code, bring it in line in the same change.
+
+Highlights:
+
+- **Layers flow top-down:** `handlers → service → repository | clients`. The lower layer
+  never knows about the upper one.
+- **Errors:** domain sentinels in `internal/entity`; lower layers wrap technical errors
+  (`fmt.Errorf("dep.Method: %w", err)`); user-facing text lives as constants in the handler
+  package, mapped from sentinels (domain → 4xx, infra → 5xx).
+- **User-facing text is English.** Don't introduce non-English strings in code or docs (the
+  admin UI's product labels are English too). See
+  [ADR-0009](docs/decisions/0009-public-ready-and-english-docs.md).
+- **Validation lives in the service layer** (sentinel errors), not in the OpenAPI schema.
+
+## Documenting changes — CHANGELOG + ADR
+
+Every PR leaves a trail:
+
+- **`CHANGELOG.md`** — one entry per PR, reverse-chronological:
+  `## YYYY-MM-DD — <short title> (#PR)` + 1–2 lines, plus an ADR link if there is one.
+- **ADRs** — for non-trivial changes (a design decision / trade-off), add
+  `docs/decisions/NNNN-<slug>.md` from `docs/decisions/0000-template.md` (Context /
+  Considered Options / Decision / Consequences). ADRs are immutable once merged; a later
+  decision that reverses one is a new ADR that `Supersedes` it.
+
+## Security & secrets
+
+Never commit secrets. `.env` is gitignored (only `.env.example` is tracked), and so is the
+SQLite store (`db/`). Panel API tokens, `SUBGEN_SECRET`, admin credentials and rendered
+per-client configs must never land in git.
+
+## Pull requests
+
+- Branch off `main`, keep the change focused, and make sure `make all` (or at least lint +
+  unit + integration) is green.
+- Include the `CHANGELOG.md` entry (and an ADR if warranted) in the same PR.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 postlog
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.