docs: update version to v1.4.7 and organize documentation

- Update package.json version to v1.4.7
- Update README.md header to v1.4.7
- Update GEMINI.md version references to v1.4.7
- Update RECOVERY_PLAYBOOK.md version to v1.4.7
- Update SECURITY_AUDIT_REPORT.md version to v1.4.7
- Move documentation files to doc/ directory for better organization
- Add new documentation files: LOCAL_TESTING_GUIDE.md, SERVE.md, TAILS_OFFLINE_PLAYBOOK.md
- Add Makefile and serve.ts for improved development workflow

serve.ts

@@ -0,0 +1,57 @@
+// Lightweight static file server using Bun
+// Run with: bun ./serve.ts
+
+import { extname } from 'path'
+
+const DIST = new URL('./dist/', import.meta.url).pathname
+
+function contentType(path: string) {
+    const ext = extname(path).toLowerCase()
+    switch (ext) {
+        case '.html': return 'text/html; charset=utf-8'
+        case '.js': return 'application/javascript; charset=utf-8'
+        case '.css': return 'text/css; charset=utf-8'
+        case '.wasm': return 'application/wasm'
+        case '.svg': return 'image/svg+xml'
+        case '.json': return 'application/json'
+        case '.png': return 'image/png'
+        case '.jpg': case '.jpeg': return 'image/jpeg'
+        case '.txt': return 'text/plain; charset=utf-8'
+        default: return 'application/octet-stream'
+    }
+}
+
+Bun.serve({
+    hostname: '127.0.0.1',
+    port: 8000,
+    fetch(request) {
+        try {
+            const url = new URL(request.url)
+            let pathname = decodeURIComponent(url.pathname)
+            if (pathname === '/' || pathname === '') pathname = '/index.html'
+
+            // prevent path traversal
+            const safePath = new URL('.' + pathname, 'file:' + DIST).pathname
+
+            // Ensure file is inside dist
+            if (!safePath.startsWith(DIST)) {
+                return new Response('Not Found', { status: 404 })
+            }
+
+            try {
+                const file = Bun.file(safePath)
+                const headers = new Headers()
+                headers.set('Content-Type', contentType(safePath))
+                // Localhost only; still set a permissive origin for local dev
+                headers.set('Access-Control-Allow-Origin', 'http://localhost')
+                return new Response(file.stream(), { status: 200, headers })
+            } catch (e) {
+                return new Response('Not Found', { status: 404 })
+            }
+        } catch (err) {
+            return new Response('Internal Server Error', { status: 500 })
+        }
+    }
+})
+
+console.log('Bun static server running at http://127.0.0.1:8000 serving ./dist')