feat: simplify initial setup with quickstart

[gildesmarais]

This pull request introduces several improvements to configuration validation, contributor documentation, and developer workflow for html2rss-web. The most significant changes include stricter validation of account tokens and environment flags, a new comprehensive CONTRIBUTING.md guide, improved configuration file handling, and updates to documentation and test automation to reflect these enhancements.

Configuration validation and security:

• Added strict validation for account tokens: empty or non-string tokens now cause a boot failure, and a placeholder create-feed token is explicitly forbidden in production when auto source is enabled. This prevents accidental misconfiguration and improves security. [1] [2] [3]
• Improved environment flag validation: unknown or invalid managed feature flags now fail fast at boot, and documentation for all flags is centralized in the new contributor guide.

Configuration file handling:

• The configuration loader (LocalConfig) now supports ERB rendering for YAML files, and exposes load_yaml and load_snapshot methods for fresh, non-memoized parsing (used for health checks to detect config drift). [1] [2] [3]
• Health check endpoint now uses the new load_snapshot method to ensure configuration validation reflects the latest file state.

Contributor and developer workflow:

• Added a new CONTRIBUTING.md with clear instructions for development, verification, architectural constraints, and environment flag documentation. All references in other files updated accordingly. [1] [2] [3] [4]
• Updated the developer README and .devcontainer/README.md to clarify quickstart instructions, contributor workflow, and to point to the new guide. [1] [2] [3]

Test automation and CI:

• The Rake test task now sets a strong default API token when auto source is enabled, and passes this token through both the container environment and test environment, ensuring smoke tests reflect production-like security. [1] [2] [3]

Other improvements:

• Minor documentation and codebase cleanup, including improved quickstart instructions and removal of outdated or redundant information in README.md.

These changes collectively improve the security, reliability, and contributor experience of the project.

[Copilot]

Pull request overview

This PR simplifies the token-gated onboarding flow by making the bundled feed/account config derive the create-feed token from HTML2RSS_ACCESS_TOKEN, tightening production validation around placeholder tokens when auto-source is enabled, and updating readiness checks + UI/docs to match the new flow.

Changes:

• Add ERB rendering to config/feeds.yml via LocalConfig so the admin token can come from HTML2RSS_ACCESS_TOKEN.
• Update production validation to fail boot when auto-source is enabled but the placeholder create-feed token is still in use.
• Adjust readiness checks to reparse current config (non-memoized) and update frontend copy + generated OpenAPI client types accordingly.

Reviewed changes

Copilot reviewed 17 out of 20 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
spec/html2rss/web/local_config_spec.rb	Adds coverage for ERB-evaluated YAML + non-memoizing load_snapshot behavior.
spec/html2rss/web/environment_validator_spec.rb	Adds spec ensuring placeholder token fails boot in production when auto-source is enabled.
spec/html2rss/web/boot/setup_spec.rb	Updates env capture/scrub expectations to include HTML2RSS_ACCESS_TOKEN.
spec/html2rss/web/app_integration_spec.rb	Updates LocalConfig stubbing to use snapshots rather than raw YAML.
spec/html2rss/web/api/v1_spec.rb	Ensures readiness reparses config (uses load_snapshot) and fails when current config is bad.
README.md	Documents quickstart compose + new HTML2RSS_ACCESS_TOKEN onboarding guidance.
public/openapi.yaml	Documents /health/ready 500 response (drives generated client typing).
frontend/src/components/AppPanels.tsx	Updates token-gate hint text and utilities wording.
frontend/src/api/generated/types.gen.ts	Regenerates OpenAPI-derived typings for readiness 500 errors.
frontend/src/api/generated/sdk.gen.ts	Regenerates SDK typing for readiness endpoint error shape.
frontend/src/api/generated/index.ts	Re-exports newly generated readiness error types.
frontend/src/tests/App.test.tsx	Updates assertions for new UI copy (“Browse included feeds”, token guidance).
examples/docker-compose.quickstart.yml	Adds a minimal “first run” compose stack (web + botasaurus) requiring HTML2RSS_ACCESS_TOKEN.
docs/README.md	Documents HTML2RSS_ACCESS_TOKEN in the managed environment key table.
docker-compose.yml	Updates header comment to clarify it’s the fuller operator stack.
config/feeds.yml	Switches admin token to ERB-backed value derived from RuntimeEnv.access_token.
app/web/config/runtime_env.rb	Tracks/scrubs HTML2RSS_ACCESS_TOKEN and exposes RuntimeEnv.access_token.
app/web/config/local_config.rb	Adds ERB rendering before YAML parse; introduces load_yaml and load_snapshot APIs.
app/web/config/environment_validator.rb	Adds placeholder create-feed token validation when auto-source is enabled in production.
app/web/api/v1/health.rb	Makes readiness/config verification reparse the current config via LocalConfig.load_snapshot.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 26 changed files in this pull request and generated 2 comments.