fix(docs): scaffolded apps publish their docs, and drop dead docs ignore rules

[rubenvdlinde]

Two commits, both about the docs site that new apps inherit from this template.

1. New apps' docs actually publish

documentation.yml listened on a documentation branch and passed no secrets. Every app scaffolded from the template got a docs pipeline that never ran. Had it run, the publish step would have skipped, because it received no Cloudflare credentials. The fleet apps were each fixed by hand. The template never was.

It now matches the fleet callers (planninq, humaniq, versioniq):

• triggers on development
• maps CF_API_TOKEN and CF_ACCOUNT_ID
• pins worker-name and lists docs-hosts

app-create's app-template to {APP_ID} substitution turns these into the new app's host ({APP_ID}.conduction.nl) and worker ({APP_ID}-docs).

The template itself does not publish. The org CF_* secrets are visible to every repo, this one included, and the deploy registers each host as a Cloudflare custom domain. So one push here would put a live app-template.conduction.nl online. The secrets are passed only when github.event.repository.is_template is false. The check deliberately avoids the repository name: app-create rewrites ConductionNL/nextcloud-app-template into the new app's repo, which would turn publishing off in every new app. The template still builds and validates its docs on every run.

This reverses #38 (2026-05-13), which chose the documentation branch so docs could deploy independently of code. Across the fleet nobody pushed to that branch after 2026-05-25, and the sites went stale. This repo has no documentation branch either.

2. Dead ignore rules

• Removed the /website/* and /docusaurus/* rules from .gitignore. Docs live in docs/, and none of the 21 fleet apps has either folder.
• The /docs/ rules stay.
• CONTRIBUTING now describes the real release path.

3. The docs lockfile

The first run of the docs job on development exposed a lockfile out of step with package.json: @conduction/docusaurus-preset pinned at 3.10.0 against ^3.12.0, so npm ci refused to install. Regenerated, and it now resolves 3.52.0. npm ci and npm run build pass locally, including all 8 AI-baseline checks.

Inherited, not fixed here

quality / Hydra Gates and quality / Quality Report fail on this PR and have failed on development every night (2a129e5, 2026-09-26 to 09-28). The job says the pinned hydra-gates package is missing paths the workflow needs. That is not a finding about this repo. E2E Tests (Playwright) is red on development too.

Verified

• actionlint 1.7.7 passes on documentation.yml.
• git check-ignore confirms docs/.docusaurus/ stays ignored.
• The template repo is flagged isTemplate: true (gh repo view). That is what the guard reads.
• Not verified yet: the guard on a live run. The shared workflow publishes only on push, so this PR's run cannot show it. The first push to development after merge must show the publish step skipped and no app-template.conduction.nl record.
• No PHP or frontend source changed, so composer check:strict was not run.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/nextcloud-app-template @ d86c52b

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
format		✅
composer			✅	✅ 103/103
npm			✅	✅ 737/737
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅
Newman					✅
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it on any branch from the Actions tab, or locally with npx playwright test.
Hydra gates					❌

---

Quality workflow — 2026-09-28 05:37 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/nextcloud-app-template @ 4de030c

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
format		✅
composer			✅	✅ 103/103
npm			✅	✅ 737/737
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅
Newman					✅
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it on any branch from the Actions tab, or locally with npx playwright test.
Hydra gates					❌

---

Quality workflow — 2026-09-28 05:50 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/nextcloud-app-template @ 7c57c24

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
format		✅
composer			✅	✅ 103/103
npm			✅	✅ 737/737
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅
Newman					✅
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it on any branch from the Actions tab, or locally with npx playwright test.
Hydra gates					❌

---

Quality workflow — 2026-09-28 07:13 UTC

Download the full PDF report from the workflow artifacts.