Prepare repository for open-source launch

[andrewzolotukhin]

Original request

Prepare xpenser for open-sourcing and promotion, make the repository visually appealing, encourage contributions, and help people learn about Cleverbrush Framework. Requested defaults were MIT license, finance-app-first positioning, GitHub Discussions for community conversation, GitHub Security Advisories for vulnerability reports, and cross-promotion links to the Cleverbrush Framework GitHub repository.

What changed

• Reworked README.md into a launch-ready project page with a finance-app-first pitch, product capabilities, Cleverbrush learning path, setup, self-hosting, API, MCP, contribution, and license sections.
• Added explicit Cleverbrush Framework source links to README.md, docs/cleverbrush-reference.md, and the public landing page: https://github.com/cleverbrush/framework.
• Added open-source project files: LICENSE, CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, issue forms, and a PR template.
• Added repository metadata to package.json while keeping the workspace private to avoid accidental npm publication.
• Updated the public landing page copy to lead with xpenser as the finance app and position Cleverbrush as the implementation/learning story.
• Added Open Graph/Twitter metadata and a committed social preview image at apps/web/public/og-image.png.
• Added a README preview screenshot at docs/assets/xpenser-landing-preview.png.
• Added a short learning path to docs/cleverbrush-reference.md and updated landing page tests for the public copy and link labels.

Reasoning

The repository already had strong implementation depth, but its public entry point was setup-heavy and missing common open-source trust and contribution signals. This change keeps the product pitch practical for users while making the Cleverbrush Framework patterns easy for developers to discover from the README, reference notes, templates, landing page, and upstream framework source repository.

The app/package workspaces remain private: true; this PR prepares the repository for source availability and contribution, not npm package publishing.

Screenshots / preview evidence

README preview asset committed in this PR:

The Open Graph image is committed at apps/web/public/og-image.png and was generated from the local landing page at 1200x630. Both images were refreshed after adding the Framework GitHub link.

Manual preview QA on https://xpenser-pr-028.cleverbrush.com confirmed the product-first landing page, sign-in/register links, deployed og-image.png at 1200x630, and the xpenser GitHub plus Framework GitHub links in the header, hero, and footer.

Validation

• npm run lint
• npm run typecheck
• npm test - 58 files, 329 tests passed
• npm run build with local build secrets and Google sign-in disabled
• Local screenshot QA of docs/assets/xpenser-landing-preview.png
• Local screenshot QA of apps/web/public/og-image.png
• GitHub Actions Lint and test from the first push
• GitHub Actions Deploy PR environment from the first push
• GitHub Actions Playwright e2e from the first push
• Preview QA on https://xpenser-pr-028.cleverbrush.com from the first push
• SigNoz check for xpenser-web-pr-28 and xpenser-api-pr-28 from the first push
• GitHub Actions rerun for commit 8551f5c: Lint and test, Deploy PR environment, and Playwright e2e all passed
• Preview QA after commit 8551f5c confirming the deployed Framework GitHub link
• SigNoz follow-up after commit 8551f5c for xpenser-web-pr-28

SigNoz notes:

• First push: web traces are present for landing, login/register RSC requests, and static assets with no trace errors observed.
• First push: API traces are present for e2e API/category/database spans with no trace errors observed.
• First push: xpenser-api-pr-28 has Node.js runtime metric data (nodejs.eventloop.utilization).
• Latest push: web traces are present after preview QA with no trace errors observed in the sampled spans.
• Log queries for PR web/API services returned no rows in the checked windows; no ERROR logs were observed, but this also means log-export coverage was not proven from this PR check.

GitHub admin follow-up

The available GitHub connector in this environment does not expose repository settings mutation for these items. After merge, set or confirm:

• Enable Discussions.
• Enable private vulnerability reporting / GitHub Security Advisories.
• Set homepage to https://xpenser.cleverbrush.com.
• Set topics: personal-finance, expense-tracker, self-hosted, typescript, nextjs, cleverbrush, mcp, openapi.
• Consider disabling Wiki/Projects if you want all public collaboration to stay in README, Issues, PRs, and Discussions.