Claude/ci cd glossary docs 5qhb7p

[vickydve]

Summary

Adds four documentation pages closing the outstanding docs issues:

• docs/ci-cd.md — reference for all nine GitHub Actions workflows (backend-ci, frontend-ci, contracts-ci, ai-agent-ci, security-ci, loadtest-nightly, pr, guard-main-branch, close-linked-issues): trigger/path-filters, jobs, and the failure signal to act on for each. Covers why apps/web/** changes don't run backend CI, guard-main-branch as the dev-only branch enforcement mechanism, contracts-ci's 100 KB WASM size gate and PR size-report comment, loadtest-nightly's baseline-regression check and where scripts/loadtest/baseline.json comes from (a static, manually-updated file), and the rust-toolchain.toml channel = "stable" toolchain-pinning caveat.
• docs/glossary.md — glossary of messaging/E2EE terms (envelope, prekey, ratchet, safety number, epoch, sealed box, fan-out), Stellar/Soroban terms (ledger, XDR, SAC, passphrase, Freighter), and project-specific coinages (device set mismatch, sibling device, resume cursor, group control event), each pointing at the implementing module. Disambiguates ciphertext (message body column) vs. envelope ciphertext, deviceId vs. senderDeviceId, and epoch (MLS) vs. sequence (group control log).
• docs/development-setup.md — start-to-finish local setup guide: prerequisites with actual pinned versions (Node 20, pnpm 10.28.1, Rust stable + wasm32-unknown-unknown, Python 3.12 via uv, Docker), the four infra/docker-compose.yml services (postgres, redis, minio, minio-init), the exact clone-to-running-app command sequence, which parts run without Docker (tests mock Redis/Postgres/S3), and scripts/start-web.sh plus Makefile targets. Flags a Node 18 vs. 20 inconsistency found across workflows.
• apps/web/docs/components-messaging.md — reference for MessageThread, InboundMessageRow, EncryptedThumbnail, and UnavailableMessagePlaceholder, with props, render locations, the message-row states (decrypted / pre-link / undecryptable / verification-failed / file-image), EncryptedThumbnail's decrypt-to-object-URL flow and its cleanup/revoke obligation, and how processEnvelope.ts distinguishes "no envelope for this device" (pre-link) from "envelope exists but decrypt failed."

Notes

• No functional code was changed — documentation only.
• apps/web/docs/components-messaging.md flags that the live conversation page currently hardcodes reason="undecryptable" instead of threading through the real unavailable reason, and that no "deleted tombstone" or "system event" message state currently exists in the messaging components — documented as-is rather than invented.

Closes #543
Closes #549
Closes #541
Closes #569

[drips-wave]

@vickydve Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits