docs: refresh CI + lint/format docs (Phase 8 + Phase 13)

docs/CONFIGURATION.md

@@ -165,6 +165,8 @@ See `docs/deployment.md` for the full `drizzle-kit migrate` command used to prep
 
 ## Config File Reference
 
+### Application Config Files
+
 There are no application-level JSON/YAML config files. The two config files that read environment variables at dev/build time are:
 
 | File                         | Purpose                                                          |
@@ -173,3 +175,53 @@ There are no application-level JSON/YAML config files. The two config files that
 | `apps/pwa/vite.config.ts`    | Vite build config — no env var reads; proxy rules for dev server |
 
 The PWA Vite dev server proxies `/health`, `/api`, and `/callback` to `http://localhost:3000` so the frontend and API can be developed without CORS configuration.
+
+### Lint and Format Config Files
+
+These files live at the repo root and apply to both `apps/api` and `apps/pwa`.
+
+#### `eslint.config.js`
+
+ESLint 9 flat config (ESM). Pinned to ESLint **9.39.4** — do not upgrade to ESLint 10 until `eslint-plugin-react` resolves the `getFilename is not a function` incompatibility.
+
+Key layers (in order):
+
+1. **Global ignores** — `**/dist/**`, `**/node_modules/**`, `apps/api/src/db/migrations/**`, `pnpm-lock.yaml`.
+2. **Base TS/TSX** (`apps/**/*.{ts,tsx}`) — `js.configs.recommended` + `tseslint.configs.recommendedTypeChecked` with `projectService: true` (auto-discovers all `tsconfig.json` files). `@typescript-eslint/no-unused-vars` allows `_`-prefixed names.
+3. **React + Hooks** (`apps/pwa/**/*.{ts,tsx}` only) — `eslint-plugin-react` flat recommended + `eslint-plugin-react-hooks` flat recommended. React Compiler rules (immutability, purity, refs, etc.) are disabled — this codebase does not use the React Compiler.
+4. **`disableTypeChecked` override** — applied to tool config files and test/e2e directories that are outside any `tsconfig` project (`apps/api/drizzle.config.ts`, `apps/api/vitest.config.ts`, `apps/pwa/vite.config.ts`, `apps/pwa/vitest.config.ts`, `apps/pwa/playwright.config.ts`, `apps/api/tests/**/*.ts`, `apps/pwa/e2e/**/*.ts`, `eslint.config.js`). Type-aware rules are disabled for these files; non-type-aware rules still apply.
+5. **`eslint-config-prettier`** (last) — disables all ESLint formatting rules that conflict with Prettier.
+
+Run lint: `pnpm lint` (delegates to `pnpm -r --if-present lint` across all workspaces).
+
+#### `.prettierrc`
+
+```json
+{
+  "semi": true,
+  "singleQuote": true,
+  "tabWidth": 2,
+  "trailingComma": "all",
+  "printWidth": 100
+}
+```
+
+Run formatter: `pnpm format` (write) or `pnpm format:check` (CI check, no writes).
+
+#### `.prettierignore`
+
+Excludes `dist/`, `node_modules/`, `.pnpm-store/`, `pnpm-lock.yaml`, `apps/api/src/db/migrations/`, `*.html`, and `.planning/` from formatting. The `.pnpm-store/` exclusion covers CI runners that have no persistent global pnpm store and land the content-addressable store inside the workspace.
+
+---
+
+## CI Secrets
+
+The Gitea Actions workflows in `.gitea/workflows/` require one repository secret.
+
+| Secret         | Scope              | Description                                                                                                                                                                                                                                                                                                                                                                    |
+| -------------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `REGISTRY_PAT` | `publish.yml` only | A Gitea user PAT with **`write:package`** scope. Used to authenticate `docker login` against the Gitea container registry before pushing the API image. **Must be named `REGISTRY_PAT`** — Gitea reserves the `GITEA_` prefix for built-in variables, so any `GITEA_`-prefixed secret name is rejected. `GITEA_TOKEN` and `GITHUB_TOKEN` do not have package-push permissions. |
+
+### CI Database Credentials
+
+The `ci.yml` `api` and `harness` jobs spin up a throwaway MariaDB service container with hardcoded credentials (`familysync` / `testpass`). These are ephemeral — scoped to a single job container — and are **not** production secrets. Do not reuse them outside CI.