docs: update contributing guide and README

- Update CONTRIBUTING.md with current bun (>=1.3.7) and node (>=24.11.0) versions
- Add bun run doctor step for environment verification
- Add bun run check command (combines lint, format, types)
- Update project structure to include admin-dashboard and workflows
- Add security reference to SECURITY.md

Author: HMarzban

CONTRIBUTING.md

@@ -25,7 +25,8 @@ By participating in this project, you agree to maintain a respectful and inclusi
 Before you begin, ensure you have:
 
 - 🐳 **Docker** & **Docker Compose** v2+ - [Install](https://docs.docker.com/get-docker/)
-- 🚀 **Bun** >=1.3.2 - [Install](https://bun.sh/docs/installation)
+- 🚀 **Bun** >=1.3.7 - [Install](https://bun.sh/docs/installation)
+- 📦 **Node.js** >=24.11.0 (for some tooling)
 - 🗄️ **Supabase CLI** - [Install](https://supabase.com/docs/guides/cli/installation)
 - **Git** - [Install](https://git-scm.com/downloads)
 
@@ -50,6 +51,14 @@ Before you begin, ensure you have:
 bun install
 ```
 
+### 1.5 Run Doctor (Optional)
+
+Check your environment is correctly set up:
+
+```bash
+bun run doctor
+```
+
 ### 2. Environment Configuration
 
 ```bash
@@ -232,12 +241,20 @@ Aim for good test coverage, especially for:
    git rebase main
    ```
 
-3. **Run tests**:
+3. **Run checks** (lint + format + types):
+
+   ```bash
+   bun run check
+   ```
+
+   Or individually:
 
    ```bash
    bun run lint
    bun run format:check
-   bun run build
+   bun run typecheck:webapp
+   bun run typecheck:admin
+   bun run typecheck:backend
    ```
 
 4. **Test locally**:
@@ -288,13 +305,16 @@ docs.plus/
 │   │   └── cypress/         # E2E tests
 │   ├── hocuspocus.server/   # ⚡ REST API, WebSocket, Workers
 │   │   ├── src/
-│   │   │   ├── api/         # API routes
-│   │   │   ├── lib/         # Shared libraries
-│   │   │   └── middleware/  # Middleware
-│   │   └── tests/           # Unit & integration tests
-│   ├── supabase/            # 🗄️ Database migrations
-│   │   └── scripts/         # SQL scripts
+│   │   │   ├── api/         # REST API routes & controllers
+│   │   │   ├── lib/         # Shared libraries (email, push, etc.)
+│   │   │   ├── middleware/  # Hono middleware
+│   │   │   └── config/      # Configuration & env schemas
+│   │   └── prisma/          # Prisma schema & migrations
+│   ├── admin-dashboard/     # 🛠️ Admin interface (Next.js)
+│   ├── supabase/            # 🗄️ Supabase configuration
+│   │   └── scripts/         # SQL migration scripts
 │   └── extension-*/         # 🔌 TipTap extensions
+├── .github/workflows/       # 🔄 CI/CD pipelines
 ├── docker-compose.dev.yml   # 🐳 Development setup
 ├── docker-compose.prod.yml  # 🚀 Production setup
 └── Makefile                 # 🛠️ Build commands
@@ -316,6 +336,7 @@ We welcome contributions in all areas:
 
 - 💬 **Discord**: [Join our server](https://discord.com/invite/25JPG38J59) for real-time help
 - 🐛 **Issues**: [GitHub Issues](https://github.com/docs-plus/docs.plus/issues) for bug reports
+- 🔒 **Security**: See [SECURITY.md](SECURITY.md) for reporting vulnerabilities
 - 📧 **Email**: [contact@newspeak.house](mailto:contact@newspeak.house)
 
 ## 🙏 Thank You!

README.md

@@ -203,55 +203,22 @@ You still need to configure your cloud project:
 - Run SQL scripts from `packages/supabase/scripts/` in order via SQL Editor
 - Configure queues and permissions (same as local setup)
 
-**Step 4: Configure Push Notifications (Vault)** 🔔
+**Backend Environment Variables:**
 
-Push notifications require configuration stored in Supabase Vault. Run these SQL commands in the **SQL Editor**:
+```env
+# Supabase connection (for pgmq polling)
+SUPABASE_URL=https://your-project.supabase.co
+SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
 
-```sql
--- Add secrets to Vault
-SELECT vault.create_secret(
-    'https://your-backend-url.com',  -- Your Hocuspocus backend URL
-    'hocuspocus_url',
-    'Hocuspocus backend URL for push notifications'
-);
-
-SELECT vault.create_secret(
-    'your-service-role-key-here',  -- From Settings → API → service_role
-    'service_role_key',
-    'Supabase service role key'
-);
-
--- Update the push config function to read from Vault
-CREATE OR REPLACE FUNCTION internal.get_push_config()
-RETURNS table (edge_url text, service_key text)
-LANGUAGE plpgsql
-SECURITY DEFINER
-AS $$
-DECLARE
-    v_hocuspocus_url text;
-    v_service_key text;
-BEGIN
-    SELECT decrypted_secret INTO v_hocuspocus_url
-    FROM vault.decrypted_secrets WHERE name = 'hocuspocus_url';
-
-    SELECT decrypted_secret INTO v_service_key
-    FROM vault.decrypted_secrets WHERE name = 'service_role_key';
-
-    IF v_hocuspocus_url IS NULL OR v_service_key IS NULL THEN
-        RETURN;
-    END IF;
-
-    RETURN QUERY SELECT
-        v_hocuspocus_url || '/api/push/send',
-        v_service_key;
-END;
-$$;
-
--- Verify configuration
-SELECT * FROM internal.get_push_config();
+# VAPID keys for Web Push
+VAPID_PUBLIC_KEY=your-vapid-public-key
+VAPID_PRIVATE_KEY=your-vapid-private-key
+VAPID_SUBJECT=mailto:support@yourdomain.com
 ```
 
-**Note:** Supabase Cloud doesn't allow `ALTER DATABASE SET` for custom parameters, so we use Vault for secure secret storage.
+Generate VAPID keys: `npx web-push generate-vapid-keys`
+
+See `docs/PUSH_NOTIFICATION_PGMQ.md` for detailed architecture.
 
 **Step 5: Configure OAuth Redirect URLs** 🔐