chore: close OSS-launch gaps — docs accuracy, issue templates, neutral copy, message deep links

- CHANGELOG: correct the stale [Unreleased] entry claiming DLQ monitoring is
  Azure-only; DlqMonitorWorker scans all providers and DlqMonitorService skips
  only unregistered ones.
- README: surface the security posture (read-only default, AES-GCM at rest,
  zero external calls, prod safety rails) as a callout at the top; replace
  stale test counts with resilient rounded figures.
- Add .github/ISSUE_TEMPLATE (bug report, feature request, config) so the
  templates CONTRIBUTING already references actually exist; security reports
  routed to SECURITY.md via contact link.
- ConnectPage: provider-neutral marketing copy (hero, empty state, how-it-works,
  comparison table) — Azure-specific text stays only in the Azure form and SAS
  instructions. No functional changes.
- MessagesPage: message-level deep links — selection is initialized from and
  mirrored to a ?message=<id> URL parameter so a specific message can be shared;
  cleared on tab/entity switch with a first-render guard so deep links survive
  page load. 4 new tests.

Frontend: 1,106 tests green, tsc clean. Backend untouched.

Author: debdevops

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,83 @@
+name: Bug report
+description: Something in ServiceHub isn't working as expected
+title: "[Bug]: "
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report a bug. Before submitting, please search
+        [existing issues](https://github.com/debdevops/servicehub/issues) to avoid duplicates.
+
+        ⚠️ **Security vulnerabilities:** do NOT report them here — see [SECURITY.md](https://github.com/debdevops/servicehub/blob/main/SECURITY.md) for responsible disclosure.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear description of the bug, and what you expected to happen instead.
+      placeholder: "When I click Replay on a DLQ message, the request fails with..."
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Connect a namespace with provider '...'
+        2. Open the Dead-Letter tab on queue '...'
+        3. Click '...'
+        4. See error
+    validations:
+      required: true
+  - type: dropdown
+    id: provider
+    attributes:
+      label: Cloud provider
+      description: Which provider does this affect?
+      options:
+        - Azure Service Bus
+        - AWS SQS/SNS
+        - GCP Pub/Sub
+        - Simulator mode
+        - Not provider-specific
+    validations:
+      required: true
+  - type: dropdown
+    id: mode
+    attributes:
+      label: Run mode
+      options:
+        - "./run.sh (development, real credentials)"
+        - "./run.sh --simulator"
+        - Self-hosted deployment
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: ServiceHub version
+      description: From the `.version` file or the version badge in the UI footer.
+      placeholder: "3.3.0"
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, .NET SDK version (`dotnet --version`), Node version (`node --version`), browser.
+      placeholder: |
+        OS: macOS 15.5
+        .NET: 10.0.100
+        Node: 22.11.0
+        Browser: Chrome 138
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs
+      description: |
+        API console output or browser console errors.
+        ⚠️ **Redact any connection strings, keys, or secrets before pasting.**
+      render: shell

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: 🔒 Report a security vulnerability
+    url: https://github.com/debdevops/servicehub/blob/main/SECURITY.md
+    about: Do NOT open a public issue for security vulnerabilities — follow the responsible disclosure process instead.
+  - name: 💬 Questions & help
+    url: https://github.com/debdevops/servicehub/discussions
+    about: Ask questions or discuss ideas before opening an issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,41 @@
+name: Feature request
+description: Suggest an idea or improvement for ServiceHub
+title: "[Feature]: "
+labels: ["enhancement", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the suggestion! Please describe the **use-case, not just the solution** —
+        understanding the problem you're solving helps us design the right feature.
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem are you trying to solve?
+      description: Describe the situation where you hit this limitation. What were you doing? What slowed you down?
+      placeholder: "During an incident I needed to replay ~500 DLQ messages matching a specific error, but..."
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: How would you like ServiceHub to solve it? Rough ideas are fine.
+    validations:
+      required: true
+  - type: dropdown
+    id: provider
+    attributes:
+      label: Which provider(s) does this involve?
+      multiple: true
+      options:
+        - Azure Service Bus
+        - AWS SQS/SNS
+        - GCP Pub/Sub
+        - Simulator mode
+        - All / not provider-specific
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives you've considered
+      description: Workarounds you use today (scripts, portal, CLI, other tools).

CHANGELOG.md

@@ -15,7 +15,7 @@
 
 - **AWS and GCP now have resilience pipelines matching Azure's retry pattern** — `AwsResiliencePipeline` and `GcpResiliencePipeline` (Polly-based, 3 retries, exponential backoff with jitter, 1s base / 30s cap) wrap the AWS SQS/SNS and GCP Pub/Sub message receivers/senders, retrying only transient errors (AWS: SDK-marked retryable or 5xx/429; GCP: `Unavailable`/`DeadlineExceeded`/`Internal`/`ResourceExhausted`/`Aborted` gRPC codes).
 - **GCP Pub/Sub message count normalized** — `GcpMessageReceiver.GetMessageCountAsync` previously could surface as a failure; Pub/Sub has no direct count API, so it now returns a neutral `Success(0)`, consistent with the existing "unsupported read" convention used elsewhere (e.g. `GetScheduledMessagesAsync`).
-- **DLQ background monitoring now skips non-Azure namespaces explicitly** — `DlqMonitorWorker` filters to Azure namespaces before scanning (DLQ monitoring is Azure-only today) and logs how many namespaces were skipped, instead of attempting and failing an Azure client build against AWS/GCP namespaces every poll cycle.
+- **DLQ background monitoring is provider-aware** — `DlqMonitorWorker` scans all active namespaces regardless of provider; `DlqMonitorService` resolves each namespace's provider through `CloudProviderRouter`, skipping only namespaces whose provider is not registered on this server (with an explanatory log entry) instead of attempting an Azure client build against AWS/GCP namespaces. Provider conventions are handled per cloud: GCP `-dlq` dead-letter topic subscriptions, Azure `DeadLetterCount` short-circuiting.
 
 ### Changed
 

README.md

@@ -25,6 +25,9 @@ Production breaks at 2 AM. Your cloud portal shows **5,000 messages in the Dead-
 
 **ServiceHub is an ultra-fast, self-hosted web application that gives engineers full forensic visibility into their cloud message queues** — like a debugger, but for Azure Service Bus, AWS SQS/SNS, and GCP Pub/Sub.
 
+> [!IMPORTANT]
+> **Built for strict environments.** Read-only by default (`Peek`, never consume) · connection strings AES-GCM-256 encrypted at rest · **zero external calls** — pattern analysis runs entirely in your browser, no message data ever leaves your network · destructive actions (replay, send) blocked on production namespaces. Details in [Security](#security).
+
 > [!TIP]
 > **No credentials?** Try the built-in [Simulator Mode](#simulator-mode) — runs 3 synthetic namespaces (Azure + AWS + GCP) with 50 seeded messages each. No cloud account needed.
 
@@ -267,10 +270,10 @@ ServiceHub uses client-side heuristic pattern detection — pure JavaScript in y
 Bug fixes, features, and documentation improvements are welcome!
 
 ```bash
-# Unit tests (Vitest — 1,045 tests, ≥60% coverage required)
+# Unit tests (Vitest — 1,100+ tests, ≥60% coverage required)
 cd apps/web && npm run test:coverage
 
-# Backend tests (xUnit — 1,327 tests)
+# Backend tests (xUnit — 1,500+ unit + integration tests)
 cd services/api && dotnet test
 
 # E2E tests (Playwright — requires ./run.sh --simulator)

apps/web/src/__tests__/pages/MessagesPage.test.tsx

@@ -24,9 +24,11 @@ vi.mock('@/hooks/useNamespaces', () => ({
 
 // Mock heavy components
 vi.mock('@/components/messages', () => ({
-  MessageList: ({ messages, onQueueTabChange, activeCounts }: any) => (
+  MessageList: ({ messages, onQueueTabChange, activeCounts, onSelectMessage, selectedId }: any) => (
     <div data-testid="message-list">
       <span>{messages.length} messages</span>
+      <span data-testid="selected-id">{selectedId ?? 'none'}</span>
+      <button onClick={() => onSelectMessage('msg-2')}>Select msg-2</button>
       <button onClick={() => onQueueTabChange('active')}>Active ({activeCounts.active})</button>
       <button onClick={() => onQueueTabChange('deadletter')}>Dead-Letter ({activeCounts.deadletter})</button>
     </div>
@@ -265,4 +267,33 @@ describe('MessagesPage', () => {
     render(<Wrapper><MessagesPage /></Wrapper>);
     expect(screen.getByTestId('message-list')).toBeInTheDocument();
   });
+
+  describe('Message deep links', () => {
+    it('restores selection from the ?message= URL parameter on load', () => {
+      const Wrapper = createWrapper('/messages?namespace=ns1&queue=test-queue&message=msg-1');
+      render(<Wrapper><MessagesPage /></Wrapper>);
+      expect(screen.getByTestId('selected-id')).toHaveTextContent('msg-1');
+    });
+
+    it('shows no selection when the URL has no message parameter', () => {
+      const Wrapper = createWrapper();
+      render(<Wrapper><MessagesPage /></Wrapper>);
+      expect(screen.getByTestId('selected-id')).toHaveTextContent('none');
+    });
+
+    it('updates selection when a message is chosen', () => {
+      const Wrapper = createWrapper();
+      render(<Wrapper><MessagesPage /></Wrapper>);
+      fireEvent.click(screen.getByText('Select msg-2'));
+      expect(screen.getByTestId('selected-id')).toHaveTextContent('msg-2');
+    });
+
+    it('clears the selection when switching queue tabs', () => {
+      const Wrapper = createWrapper('/messages?namespace=ns1&queue=test-queue&message=msg-1');
+      render(<Wrapper><MessagesPage /></Wrapper>);
+      expect(screen.getByTestId('selected-id')).toHaveTextContent('msg-1');
+      fireEvent.click(screen.getByText(/Dead-Letter \(/));
+      expect(screen.getByTestId('selected-id')).toHaveTextContent('none');
+    });
+  });
 });

apps/web/src/pages/ConnectPage.tsx

@@ -12,7 +12,7 @@ import toast from 'react-hot-toast';
 /**
  * Connection Setup Page
  * 
- * Onboarding-style screen for connecting to Azure Service Bus namespaces.
+ * Onboarding-style screen for connecting cloud messaging namespaces (Azure Service Bus, AWS SQS/SNS, GCP Pub/Sub).
  */
 export function ConnectPage() {
   const navigate = useNavigate();
@@ -244,7 +244,7 @@ export function ConnectPage() {
             <span className="text-xs font-semibold text-sky-700">Free · Open Source · No installation</span>
           </div>
           <h1 className="text-2xl font-bold text-gray-900 leading-tight">
-            Debug Azure Service Bus{' '}
+            Debug your cloud message queues{' '}
             <span className="text-primary-600">in seconds.</span>
           </h1>
           <p className="text-sm text-gray-500 mt-1">
@@ -816,7 +816,7 @@ export function ConnectPage() {
                       <span className="text-2xl">📭</span>
                     </div>
                     <h3 className="font-medium text-gray-900 mb-1">No saved connections yet</h3>
-                    <p className="text-sm text-gray-500">Add your first Service Bus to get started</p>
+                    <p className="text-sm text-gray-500">Connect your first namespace to get started</p>
                   </div>
                 )}
               </div>
@@ -885,7 +885,7 @@ export function ConnectPage() {
                 <span className="text-sm font-bold text-primary-600">1</span>
               </div>
               <p className="text-sm font-semibold text-gray-900">60 seconds to your first message view</p>
-              <p className="text-xs text-gray-500 mt-1.5">Paste a Listen-only connection string — no admin rights, no Azure Portal clutter, no SDK to install</p>
+              <p className="text-xs text-gray-500 mt-1.5">Paste read-only credentials — no admin rights, no cloud console clutter, no SDK to install</p>
             </div>
             <div className="text-center p-5 bg-white rounded-xl border border-gray-200 shadow-sm">
               <div className="w-9 h-9 bg-primary-50 border border-primary-100 rounded-full flex items-center justify-center mx-auto mb-3">
@@ -918,7 +918,7 @@ export function ConnectPage() {
               <h4 className="font-semibold text-gray-900 mb-2">847 messages failing? Find the pattern in 30 seconds.</h4>
               <p className="text-xs text-gray-600">
                 Group by error, spot the duplicate root cause (null ref, version mismatch, timeout), apply a fix, 1-click bulk replay.
-                Azure Portal: 30 min. ServiceHub: 2 min.
+                Cloud console: 30 min. ServiceHub: 2 min.
               </p>
             </div>
 
@@ -953,7 +953,7 @@ export function ConnectPage() {
           <div className="bg-gradient-to-br from-gray-50 to-white rounded-xl border border-gray-200 p-6">
             <h4 className="text-sm font-bold text-gray-800 mb-4 flex items-center gap-2">
               <span className="text-base">⚡</span>
-              ServiceHub vs Azure Portal
+              ServiceHub vs Cloud Consoles
             </h4>
             <div className="space-y-3 text-sm">
               {[
@@ -971,7 +971,7 @@ export function ConnectPage() {
               ))}
               <div className="flex items-center text-[10px] text-gray-400 pt-1 border-t border-gray-100">
                 <span className="flex-1" />
-                <span className="w-24 text-center">Azure Portal</span>
+                <span className="w-24 text-center">Cloud Console</span>
                 <span className="w-24 text-center text-primary-600 font-semibold">ServiceHub</span>
               </div>
             </div>

apps/web/src/pages/MessagesPage.tsx

@@ -1,4 +1,4 @@
-import { useState, useMemo, useEffect, useDeferredValue } from 'react';
+import { useState, useMemo, useEffect, useRef, useDeferredValue } from 'react';
 import { useSearchParams, useNavigate } from 'react-router-dom';
 import { useQueryClient } from '@tanstack/react-query';
 import { Search, Filter, RefreshCw, Sparkles, X, AlertCircle, Play, Pause } from 'lucide-react';
@@ -143,8 +143,21 @@ export function MessagesPage() {
     }
   }, [namespaces, namespaceId, searchParams, setSearchParams]);
 
-  // Selected message for detail panel
-  const [selectedMessageId, setSelectedMessageId] = useState<string | null>(null);
+  // Selected message for detail panel — initialized from the URL so message
+  // links ("?message=<id>") can be shared and restore the selection on load
+  const [selectedMessageId, setSelectedMessageId] = useState<string | null>(
+    () => searchParams.get('message')
+  );
+
+  const syncMessageParam = (id: string | null) => {
+    const newParams = new URLSearchParams(searchParams);
+    if (id) {
+      newParams.set('message', id);
+    } else {
+      newParams.delete('message');
+    }
+    setSearchParams(newParams, { replace: true });
+  };
 
   // Queue tab: active or deadletter (sync with URL parameter)
   const [queueTab, setQueueTab] = useState<QueueTab>('active');
@@ -166,8 +179,14 @@ export function MessagesPage() {
     }
   }, [queueTypeParam]);
 
-  // Clear selection when switching queues/topics to prevent stale detail panel
+  // Clear selection when switching queues/topics to prevent stale detail panel.
+  // Skipped on first render so a deep-linked "?message=<id>" selection survives page load.
+  const isFirstEntityRender = useRef(true);
   useEffect(() => {
+    if (isFirstEntityRender.current) {
+      isFirstEntityRender.current = false;
+      return;
+    }
     setSelectedMessageId(null);
   }, [namespaceId, queueName, topicName, subscriptionName]);
 
@@ -337,19 +356,21 @@ export function MessagesPage() {
     setPaginationState(prev => ({ ...prev, skip: prev.skip + BATCH_SIZE }));
   };
 
-  // Handle message selection
+  // Handle message selection — mirrored into the URL so the link is shareable
   const handleSelectMessage = (id: string) => {
     setSelectedMessageId(id);
+    syncMessageParam(id);
   };
 
   // Handle queue tab change
   const handleQueueTabChange = (tab: QueueTab) => {
     setQueueTab(tab);
     setSelectedMessageId(null); // Clear selection when switching tabs
-    
-    // Update URL to keep it in sync with tab state
+
+    // Update URL to keep it in sync with tab state (and drop the stale message link)
     const newParams = new URLSearchParams(searchParams);
     newParams.set('queueType', tab);
+    newParams.delete('message');
     setSearchParams(newParams, { replace: true });
 
     // Refresh counts when switching between active/dlq tabs