Repo tidy + version unification for v0.10.0

[deymosh]

Final ordering pass before the first CodeDeck+ release. No behaviour changes — version strings, one file move, npm metadata, docs, and a stale-lockfile fix.

Organization review

docker-compose.yml stays at the root. Its build.context is . (the Dockerfile COPYs packages/ and apps/bridge/), Compose autoloads .env from where it runs, docker compose up from the root is the idiomatic entrypoint, and ./codedeck already wraps the day-to-day commands. Moving it to docker/ would force -f docker/docker-compose.yml --project-directory . on every raw call for a cosmetic gain.

package.json and the pnpm files are not duplicated. Root package.json + pnpm-lock.yaml + pnpm-workspace.yaml + tsconfig.base.json are the workspace definition — one each, required at the root, not movable. The vendor/bridge/ and vendor/mobile/ copies of those files are the pristine git-subtree mirrors: not in the workspace glob, never installed, must not be edited (breaks git subtree pull). The only genuine double-declaration is ws (root + packages/core) and it is deliberate — docker/main.js runs as /app/main.js and needs ws resolvable at the image's workspace root. The real disorder was version drift, fixed below.

Changes

1. chore: unify all package versions to 0.10.0 — the six manifests had drifted (0.1.0 / 0.9.3 / 0.9.4 / 0.9.5). One number for the first release: a minor step over upstream's 0.9.5 reflecting the fork's added features (Tor/SOCKS5, Orbot, NIP-42, monorepo, CI/release), still 0.x. Touches every package.json + apps/mobile/src-tauri/{tauri.conf.json,Cargo.toml} + the codedeck-mobile entry in Cargo.lock (third-party 0.9.x crates left alone). gen/android is untouched — Tauri regenerates versionName/versionCode from tauri.conf.json at build time.

2. chore: move the Docker entry shim to docker/main.js — main.js was a 3-line container-only shim sitting at the repo root. git mv to docker/; the Dockerfile COPY source path changes, the /app/main.js destination does not, so entrypoint.sh and the shim's own import are unchanged. Verified with a full docker compose build codedeck-bridge.

3. chore(bridge): point npm metadata at the codedeck-plus repo — the published bridge package still had repository.url -> JeroenOnNostr/codedeck-next-bridge and repository.directory -> apps/bridge-cli (gone), plus a README install line for upstream's v0.9.3 asset. Updated to deymosh/codedeck-plus / apps/bridge / the v0.10.0 tarball name.

4. docs: refresh the README — layout diagram now shows .github/, .claude/, docs/, docker/main.js, ./codedeck, and notes the inert vendor/* manifests; new Releases section (what a vX.Y.Z tag produces, prerelease-on-hyphen, workflow_dispatch dry run, the four signing secrets); CI badge.

5. fix(mobile): add the missing tauri-plugin-tor-proxy entry to Cargo.lock — pre-existing breakage this PR surfaced: the Orbot plugin was added to src-tauri/Cargo.toml but Cargo.lock was never regenerated, so cargo --locked fails on it. It went unnoticed because the CI cargo job is path-filtered to src-tauri/** and no prior PR touched that tree. cargo metadata --locked (Rust 1.98) now passes for host and the aarch64-linux-android target; +11 lines, no other churn.

Out of scope (agreed)

Not moving docker-compose.yml; not editing the vendor/* mirror manifests; no ESLint config or hand-written CHANGELOG (releases use generate_release_notes). The v0.10.0 tag itself is left for the maintainer to cut via the cut-release skill once the signing secrets are set.

Verification

• ./codedeck check (Docker typecheck + test, 6 packages) — green (765 mobile + 454 core + ...).
• docker compose build codedeck-bridge — green (validates the docker/main.js COPY).
• CI on this PR: typecheck + test + build green, cargo test --locked green (5m Rust run).
• git grep -nE "0\.9\.[345]" -- '*.json' '*.toml' clean outside third-party Cargo.lock crates, the vendor/* mirrors, and historical zapstore.yaml comments.