Initial WatchLink scaffold

.codex/project.md

@@ -0,0 +1,69 @@
+# Codex Project Notes
+
+## Project
+
+`WatchLink` is a Dockerized Next.js + Postgres web app for persistent shared watch rooms with accounts, friends, roles, permissions, admin setup, and realtime playback sync.
+
+Repository:
+
+```text
+MrSphay/WatchLink
+```
+
+## Commands
+
+```text
+Install: npm install
+Dev: npm run dev
+Lint: npm run lint
+Typecheck: npm run typecheck
+Test: npm run test
+Build: npm run build
+Audit: npm run audit
+Release check: npm run release:check
+Docker: docker compose up --build
+```
+
+## Stack
+
+```text
+Next.js App Router, React, TypeScript, Prisma, Postgres, Socket.IO, Docker
+```
+
+Package manager:
+
+```text
+npm
+```
+
+## Build Artifacts
+
+Next.js standalone build output:
+
+```text
+.next/standalone
+```
+
+Docker image:
+
+```text
+git.wilkensxl.de/MrSphay/watchlink:latest
+```
+
+## Security Rules
+
+- Do not commit secrets, `.env` files, tokens, private keys, or certificates.
+- Use `.env.example` for documentation only.
+- Review `docs/security-review.md` before release work.
+- Keep package publishing secrets in Gitea secrets as `REGISTRY_TOKEN`.
+
+## Release Rules
+
+Before a release:
+
+1. run `npm run release:check`,
+2. verify Docker build,
+3. verify Gitea Actions are green,
+4. verify the pushed container image can be pulled,
+5. update README and changelog,
+6. create tags/releases only when explicitly requested.