feat(docs): docs plugin — velite content pipeline, read-only API + public UI

[elliotBraem]

Closes #444
Implements #445, #446, #447, #448, #449

Summary

The repository's own markdown becomes the product: the new docs plugin compiles docs/** + GLOSSARY.md at build time with Velite and serves it read-only — no database, no secrets, no publishing pipeline. Content truth is git; edits land via merge → CI deploy → recompile.

plugins/docs/
├── velite.config.ts        # content root = repo docs/; slug/title/tags/order schema
├── build.config.ts         # VeliteContentPlugin → rspack beforeCompile hook
├── src/
│   ├── contract.ts         # listPublished (q/tag/limit/cursor) + getBySlug
│   ├── service.ts          # DocsService — pure, fixture-tested
│   └── index.ts            # createPlugin; imports compiled .velite JSON
└── ui/src/routes/
    ├── _public/docs.tsx        # layout (Outlet)
    ├── _public/docs/index.tsx  # /docs index — nav via staticData.nav (book icon)
    └── _public/docs/$.tsx      # splat reader — shared MarkdownRenderer

Enabling change: createPluginBaseConfig gains extraPlugins — the sanctioned escape hatch for build-time integrations (build.config.ts appends rspack plugin instances after the composed defaults).

Design notes: client-side rendering with one shared MarkdownRenderer (react-markdown + shiki JS engine — no WASM in the bundle), so any future draft-editor preview gets parity by construction. Editing, drafts, and a publish/PR pipeline are explicit non-goals (follow-up epics at the existing seam). The plugin dogfoods itself: its documentation lives in docs/plugins/docs-plugin.md and renders through its own pipeline.

Evidence

• Before: no /docs route; createPluginBaseConfig dropped options.rspack.plugins (hardcoded after the spread).
• After:
  • every-plugin build compiles content inside the rspack train ([VELITE] build finished in the log; clean-checkout verified by deleting .velite first) — 132 docs, unique slugs, glossary included
  • Live stack: POST /api/rpc/docs/getBySlug → glossary JSON through the host's plugin RPC; plugin's own OpenAPI surface serves REST GET /api/docs/{slug} (+ 404s unknown slugs)
  • Browser spec (tests/regression/browser/specs/docs-plugin.spec.ts): 3/3 green with trace artifacts — index lists ≥10 docs, click-through renders reader with highlighted code, unknown slug renders not-found
  • plugin-base-config.test.ts: 3/3 — extras appended after defaults, order preserved, defaults unchanged without overrides
  • Typecheck train 14/14 · lint 0 errors · full test suite green (1291 + 194 + 140 across workspaces)

Merge Danger

Door: two-way

Revert the commit and the app returns to the core-only tree; nothing persisted (no migrations, no config state beyond one bos.app.ts entry).

Blast Radius: platform-wide

The composition changes every deploy: bos.app.ts registers a new plugin (host loads it in the plugin DAG), every-plugin's build composition gains the extraPlugins merge point (no behavior change when unused — covered by test), and the core sidebar map adds the book icon (additive). Velite pins zod v3 internally for its own config — isolated to the build step, no runtime sharing.

[railway-app]

🚅 Deployed to the everything-dev-pr-450 environment in heartfelt-ambition

Service	Status	Web	Updated
upload.everything.dev	✅ Success (View Logs)		Oct 18, 2026 at 10:44 pm UTC

8 services not affected by this PR

• dev-app
• api-db-6AR0
• auth-db
• api-db
• auth-db-ISTt
• projects-db
• projects
• app