chore: alinea NEUBAT al contrato P0/P1/P2

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @Alexendros

.github/ISSUE_TEMPLATE/bug.md

@@ -0,0 +1,28 @@
+---
+name: Bug
+description: Comportamiento incorrecto de NEUBAT
+---
+
+### Propósito de este documento
+
+- **Objetivos:** Recoger un fallo reproducible (portal, instalador o ISO) sin filtrar secretos.
+- **Estructura:** Comando y salida → esperado vs obtenido → reproducción → entorno.
+- **Contenido a integrar según contexto:** Adapta el formulario a NEUBAT. Adjunta logs mínimos sintéticos; no pegues `ADMIN_TOKEN`, HMAC, `.env` ni keyfiles LUKS.
+
+## Comando y salida
+
+```bash
+# comando ejecutado + salida relevante (sin secretos)
+```
+
+## Esperado vs obtenido
+
+<!-- qué esperabas y qué obtuviste -->
+
+## Reproducción
+
+<!-- perfil JSON, token sintético, pasos de portal o script -->
+
+## Entorno
+
+<!-- node --version, commit/branch, BIOS/UEFI, disco (sda/nvme) -->

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Vulnerabilidad de seguridad
+    url: https://github.com/Alexendros/neubat/security/advisories/new
+    about: No abras un issue público. Sigue SECURITY.md.
+  - name: Documentación
+    url: https://github.com/Alexendros/neubat/blob/main/README.md
+    about: README, AGENTS.md, ARCHITECTURE.md y docs/ antes de abrir un issue.

.github/ISSUE_TEMPLATE/feature.md

@@ -0,0 +1,22 @@
+---
+name: Feature
+description: Propuesta de mejora para NEUBAT
+---
+
+### Propósito de este documento
+
+- **Objetivos:** Recoger una propuesta de mejora del portal, instalador o perfiles con impacto de contrato.
+- **Estructura:** Problema → propuesta → impacto (API, JSON, particionado, HMAC).
+- **Contenido a integrar según contexto:** Adapta el formulario a NEUBAT. Si toca contrato, enlaza un ADR en `docs/architecture/decisions/`.
+
+## Problema
+
+<!-- qué duele hoy -->
+
+## Propuesta
+
+<!-- API, script, perfil o flag + ejemplo de uso -->
+
+## Impacto en contrato
+
+<!-- ¿toca /api/*, configs/*.json, tokens, HMAC, particionado? Si sí, exige ADR -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,19 @@
+<!-- canon-managed: true -->
+
+### Propósito de este documento
+
+- **Objetivos:** Plantilla de PR para describir el cambio y exigir las comprobaciones `lint` / `test` / `smoke` / `validate` y los jobs `quality` / `test` / `smoke`.
+- **Estructura:** Qué cambia → checklist (Make, docs, artefactos, CI).
+- **Contenido a integrar según contexto:** Adapta el checklist a NEUBAT. No copies plantillas de otro producto. `test-vm` y `build-iso` son opt-in.
+
+## Qué cambia
+
+<!-- feat/fix/docs + alcance en una o dos frases -->
+
+## Checklist
+
+- [ ] `make lint && make test && make smoke && make validate`
+- [ ] Si toca frontend: `make test-frontend && make build-frontend`
+- [ ] Docs actualizadas (`README.md`, `ARCHITECTURE.md` o ADR si cambia contrato)
+- [ ] Sin artefactos (`out/`, `portal/public/assets/`, `coverage/`) ni secretos
+- [ ] CI `quality` / `test` / `smoke` en verde (`build` si aplica)

.github/renovate.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "timezone": "Europe/Madrid",
+  "labels": ["dependencies"],
+  "schedule": ["before 10am on monday"],
+  "rangeStrategy": "bump",
+  "dependencyDashboard": true,
+  "semanticCommits": "enabled",
+  "rebaseWhen": "behind-base-branch",
+  "enabledManagers": ["npm", "github-actions"],
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": ["before 10am on monday"]
+  },
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "labels": ["security"]
+  },
+  "packageRules": [
+    {
+      "matchManagers": ["npm"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "npm (non-major)",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "GitHub Actions (non-major)",
+      "automerge": true
+    },
+    {
+      "matchUpdateTypes": ["major"],
+      "automerge": false,
+      "labels": ["dependencies", "breaking-change"]
+    }
+  ]
+}

.github/workflows/ci.yml

@@ -1,14 +1,23 @@
 name: CI
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [main]
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
-  validate:
+  quality:
+    name: quality
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
 
@@ -17,17 +26,35 @@ jobs:
         with:
           node-version: 22
           cache: npm
-          cache-dependency-path: portal/package-lock.json
+          cache-dependency-path: |
+            portal/package-lock.json
+            portal/frontend/package-lock.json
 
       - name: Install portal dependencies
         run: cd portal && npm ci
 
+      - name: Install frontend dependencies
+        run: cd portal/frontend && npm ci
+
+      - name: Install shellcheck and Ansible
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y shellcheck ansible
+          pip3 install ansible-lint --break-system-packages || pip3 install ansible-lint
+
       - name: Validate scripts and configs
         run: make validate
 
+      - name: Lint shell and frontend
+        run: make lint
+
+      - name: Validate Ansible
+        run: make test-ansible
+
   test:
+    name: test
     runs-on: ubuntu-latest
-    needs: validate
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
@@ -36,55 +63,63 @@ jobs:
         with:
           node-version: 22
           cache: npm
-          cache-dependency-path: portal/package-lock.json
+          cache-dependency-path: |
+            portal/package-lock.json
+            portal/frontend/package-lock.json
 
       - name: Install portal dependencies
         run: cd portal && npm ci
 
-      - name: Run portal tests
-        run: make test
-
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install shellcheck
-        run: sudo apt-get update && sudo apt-get install -y shellcheck
-
-      - name: Run shellcheck
-        run: make lint
-
-  test-bash:
-    runs-on: ubuntu-latest
-    needs: validate
-    steps:
-      - uses: actions/checkout@v4
+      - name: Install frontend dependencies
+        run: cd portal/frontend && npm ci
 
       - name: Install bats
         run: sudo apt-get update && sudo apt-get install -y bats
 
+      - name: Run portal tests
+        run: make test
+
+      - name: Run frontend tests
+        run: cd portal/frontend && npm test
+
       - name: Run bats tests
         run: make test-bash
 
-  ansible:
+  build:
+    name: build
     runs-on: ubuntu-latest
-    needs: validate
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install Ansible
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y ansible
-          pip3 install ansible-lint --break-system-packages || pip3 install ansible-lint
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: portal/frontend/package-lock.json
 
-      - name: Validate Ansible
-        run: make test-ansible
+      - name: Install frontend dependencies
+        run: cd portal/frontend && npm ci
 
-  test-frontend:
+      - name: Build frontend for production
+        run: make build-frontend
+
+      - name: Upload frontend artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: neubat-frontend
+          path: |
+            portal/public/index.html
+            portal/public/assets/
+            portal/public/favicon.svg
+          if-no-files-found: error
+          retention-days: 7
+
+  smoke:
+    name: smoke
     runs-on: ubuntu-latest
-    needs: validate
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
 
@@ -93,14 +128,19 @@ jobs:
         with:
           node-version: 22
           cache: npm
-          cache-dependency-path: portal/frontend/package-lock.json
+          cache-dependency-path: |
+            portal/package-lock.json
+            portal/frontend/package-lock.json
+
+      - name: Install portal dependencies
+        run: cd portal && npm ci
+
+      - name: API smoke (health + install)
+        run: make smoke
 
       - name: Install frontend dependencies
         run: cd portal/frontend && npm ci
 
-      - name: Run frontend tests
-        run: cd portal/frontend && npm test
-
       - name: Install axe-core for a11y smoke
         run: cd portal/frontend && npm install --no-save axe-core jsdom
 
@@ -134,22 +174,3 @@ jobs:
             })
             .catch((err) => { console.error(err); process.exit(1); });
           NODE
-
-  build-frontend:
-    runs-on: ubuntu-latest
-    needs: validate
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: portal/frontend/package-lock.json
-
-      - name: Install frontend dependencies
-        run: cd portal/frontend && npm ci
-
-      - name: Build frontend for production
-        run: make build-frontend

.gitignore

@@ -2,6 +2,10 @@
 node_modules/
 npm-debug.log*
 
+# Secretos locales (usa .env.example)
+.env
+.env.local
+
 # Datos en runtime del portal
 portal/data/
 portal/configs/generated/