Document the architecture, the account API, localization and limitationsdocs/api-and-web-reference

The repository had a README and two operations notes. This adds the
documents a contributor or operator needs and corrects what had gone stale.

New, under docs/:
- README.md: index of the documentation.
- ARCHITECTURE.md: the two processes, the three hosts, the host-aware
  routing rules, the account flow and the trust boundaries.
- ACCOUNT-API.md: every endpoint with its request, responses and errors,
  the field rules, the Google flow outcome by outcome, cookies, limits and
  configuration. The responses were checked against a locally running API.
- LOCALIZATION.md: the four languages, how a page picks one, the cookie,
  how Hebrew text is laid out, and how to add a language.
- DEVELOPMENT.md: requirements, local setup, checks, tests, what each CI
  workflow enforces, the audit exception and the DocFX project.
- LIMITATIONS.md: what is missing or temporary, with the consequence of
  each: the in-memory account store, unverified addresses, no mail, no
  password change, the ignored returnTo parameter, the legacy ViGet status
  route, and that the API answers 500 to everything while the Google
  settings are empty.

Updated:
- README.md: languages, a documentation section, the local API command
  with its port, and the DocFX check.
- ops/README.md: restarting the API deletes every account, how to release
  a frontend-only change without that restart, and lessons from past
  releases.
- ops/mail/README.md: a status note that the API does not send mail yet.
- The pull request template names all four languages.

No source file changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 20 insertions, 0 deletions

diff --git a/docs/README.md b/docs/README.md
new file mode 100644
index 0000000..f799195
--- /dev/null
+++ b/docs/README.md
@@ -0,0 +1,20 @@
+<!-- SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com> -->
+<!-- SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1 -->
+
+# Progmaweb documentation
+
+These documents describe Progmaweb as it is built today. Where something is planned but not implemented, the text says
+so; [Known limitations](LIMITATIONS.md) collects those places.
+
+| Document | Read it when you want to know |
+| --- | --- |
+| [Architecture](ARCHITECTURE.md) | which process serves which host, how a request travels, and where the trust boundaries are |
+| [Account API](ACCOUNT-API.md) | every endpoint of the account service: requests, responses, errors, cookies and limits |
+| [Localization](LOCALIZATION.md) | which languages are published, how a page picks one, how Hebrew is laid out, and how to add a language |
+| [Development](DEVELOPMENT.md) | how to run, test and document the project locally, and what each CI check enforces |
+| [Known limitations](LIMITATIONS.md) | what is deliberately missing or temporary, and what that means for operations |
+| [Operations](../ops/README.md) | the release layout on the server and the activation contract |
+| [Mail boundary](../ops/mail/README.md) | the mail host that belongs to the account service |
+| [API reference](api/index.md) | the DocFX project that builds a reference from the C# sources |
+
+The [repository README](../README.md) is the short introduction; start there if you are new.