docs: setup, hosting, API, architecture and roadmap

- SETUP: local dev guide (env vars, DB migrate, backend/frontend, troubleshooting)
- HOSTING: bare-metal guide (systemd + Nginx + TLS + backups) and Docker Compose
  guide (deploy, reverse proxy, updates, backup/restore)
- API: REST contract with curl examples and Socket.IO event protocol
- ARCHITECTURE: stack, data model, auth model, realtime design, theming
- ROADMAP: webapp MVP/next steps plus Tauri desktop clients for Windows, macOS
  and Linux with release-binary plan

docs/ROADMAP.md

@@ -0,0 +1,60 @@
+# Roadmap
+
+## Phase 1 — Web app MVP (this repo, v0.1) ✅
+
+- [x] Auth (register/login/JWT), workspaces, invites, roles
+- [x] Nested pages, TipTap rich text, comments, search
+- [x] Socket.IO realtime (live updates, presence, typing)
+- [x] Light/dark mode
+- [x] Bare-metal + Docker Compose hosting docs
+- [ ] Hardening: refresh tokens, email verification, password reset
+- [ ] Tests: backend integration tests (auth/workspaces/pages), frontend smoke test
+- [ ] Uploads: cover images / attachments (S3-compatible or local volume)
+
+## Phase 2 — Collaboration+ (v0.2)
+
+- [ ] Yjs (Hocuspocus) CRDT editing to replace last-write-wins
+- [ ] Page sharing links (public read-only), granular page permissions
+- [ ] Version history / restore snapshots
+- [ ] Notifications (mentions, invites) + activity feed
+- [ ] i18n (English + German at minimum)
+
+## Phase 3 — Desktop clients (v0.3): Windows / macOS / Linux binaries
+
+Goal: installable desktop apps published as **GitHub/Gitea Release binaries**
+(`.exe`/`.msi`, `.dmg`, `.AppImage`/`.deb`).
+
+**Chosen approach: Tauri v2** (Rust core + existing Vue frontend as webview):
+- Small binaries (~10MB), native OS integration, auto-updater support.
+- Alternative considered: Electron (larger, heavier) — fallback if native modules block Tauri.
+
+Steps:
+
+1. [ ] Add `src-tauri/` (Tauri v2 init), reuse `frontend/dist` as bundle frontend.
+2. [ ] Deep-link + offline cache: bundle API base-URL setting screen; local-first
+   drafts in IndexedDB with background sync.
+3. [ ] CI build matrix (Gitea Actions / GitHub Actions):
+   `tauri-action` on `windows-latest`, `macos-latest`, `ubuntu-latest`.
+4. [ ] Code signing: Windows (SignPath/Azure Trusted Signing), macOS (Developer ID
+   + notarization), Linux (GPG `.sig` + checksums).
+5. [ ] Auto-update feed (`updater.json` in Releases) + in-app update prompt.
+6. [ ] Publish flow: tag `vX.Y.Z` -> CI builds 3 binaries -> attach to
+   `https://git.sysdaemon.xyz/x3/openStack/releases`.
+7. [ ] Distribution extras: winget/Scoop manifests, Homebrew cask, Flathub submission.
+
+Release artifact naming:
+
+```text
+openStack_0.3.0_x64-setup.exe      (Windows)
+openStack_0.3.0_x64.dmg            (macOS Intel)
+openStack_0.3.0_aarch64.dmg        (macOS Apple Silicon)
+openStack_0.3.0_amd64.AppImage     (Linux)
+```
+
+Track desktop work in issues with label `client`. Web app remains the primary target
+until v0.3; API stays compatible (desktop = wrapper around the same frontend + API).
+
+## Phase 4 — Mobile / polish (v0.4+, tentative)
+
+- [ ] PWA packaging (installable web app) before native mobile
+- [ ] Evaluate Capacitor/Tauri-mobile for Android/iOS