docs(phase6): documentation site, landing page and open-source scaffolding

Material for MkDocs under docs/, covering self-hosting, the Rune, the
quick-add and filter languages, importing from Todoist, CalDAV,
mail-to-task, MCP, the AI layer and the API. The version is pinned: the
maintainers have announced that MkDocs 2.0 removes the plugin system
with no migration path, and an unpinned install would break this build
on the day it lands.

The landing page shows the quick-add parser as actual text rather than a
screenshot of it — that is the thing worth showing, and it reads better
as the real thing. It shares the app's design tokens, so the site and
what it describes look like one project.

MIT licence, contributing guide, security policy and issue templates.
Pages deployment is behind workflow_dispatch, so the docs build on every
push but nothing is published until the owner chooses to.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/rune.md

@@ -0,0 +1,47 @@
+# Installing as a Rune
+
+verdande ships with a Rune manifest for
+[Yggdrasil Panel](https://github.com/kristianwind/yggdrasil).
+
+## Installing
+
+1. **Runes → Carve a rune (upload)** and pick
+   [`rune/verdande.yaml`](https://github.com/kristianwind/verdande/blob/main/rune/verdande.yaml)
+   from the repository.
+2. Create a server from it.
+3. Fill in the settings below.
+4. Start it, open the URL, create the first account.
+
+## Settings
+
+| Setting | What to put |
+|---|---|
+| **Public address** | The address you reach it on. `{{PUBLIC_URL}}` is the default and usually right. |
+| **SMTP host** | Your mail server. Leave blank and invite links are shown in the app instead of emailed. |
+| **SMTP port** | 587 for STARTTLS, 465 for implicit TLS. |
+| **SMTP username / password** | As your mail server expects. |
+| **Sender address** | What invites and reminders come from. |
+| **Use STARTTLS** | On, unless you are on port 465. |
+| **How long a login lasts** | `720h` — thirty days. |
+
+!!! note "Why the public address cannot be guessed"
+    The host port is not chosen until the server is created, so verdande has no way
+    to work out its own address. The panel does, and passes it in as
+    `{{PUBLIC_URL}}`.
+
+## Reaching it from outside
+
+Give the server a **Subdomain** under its settings and enable
+**Cloudflare Tunnel (subdomains)** under **Settings → Network**. No port forwarding
+and no public IP.
+
+## Backups
+
+The Rune's backup includes the whole `/data` directory, which is what you want —
+see [the warning about copying the database alone](self-hosting.md#what-lives-in-data).
+
+## Watchers
+
+The manifest ships log watchers for database errors, repeated failed logins and
+HTTP 5xx. They appear under **Settings → Kvasir Watchers** as ordinary per-server
+rules you can edit or turn off.