ci: fork verification pipeline, deploy gate, secret placeholders, audit Round 4

[JOY (JOY)]

What

1. Fork CI (audit HI-09) - new fork-ci.yml runs type-check + lint + unit tests on pull_request and push to dev/main. The upstream All checks workflow only fires on merge_group and is guarded to calcom/cal.diy, so nothing verified this fork until now.
2. Deploy gate (audit HI-09) - deploy-docker.yml now requires a type-check job to pass before publishing :latest to GHCR.
3. Secret placeholders (audit CR-08 + LO-13) - apps/api/v2/.env.example shipped real NEXTAUTH_SECRET / JWT_SECRET / CALENDSO_ENCRYPTION_KEY / CALCOM_SERVICE_ACCOUNT_ENCRYPTION_KEY values and README-PLATFORM.md embedded a fully-signed example JWT. All replaced with placeholders.
4. Audit report Round 4 - docs/audit/2026-09-08-audit-report.html: records fixes verified in code since the last update (MD-03, MD-05/06, LO-02, LO-03, MD-29), marks HI-09/CR-08 fixed, adds a status badge to every finding, switches to native dark theme.
5. Feature gap report - docs/audit/2026-09-16-calcom-vs-crove-cal-gap.html (new, Vietnamese, dark): Cal.com features v6.2-v6.9 the fork lacks, each with repo verification evidence and a recommended order. Context: Cal.com went closed source in 2026-04, so none of this can arrive via upstream sync anymore.

Evidence

• Verified remaining-tail state in code on 2026-09-16 before writing status (grep + git log per finding).
• Inline script of the audit report passes node --check; STATUS map covers all 76 findings.

Risk

• CI may need tuning on first real run (secrets such as TURBO_TOKEN are absent on this repo - jobs degrade to local cache).
• Cron workflows (HI-10) intentionally NOT enabled yet: they need fork secrets (CRON_SECRET etc.) configured first.

🤖 Generated by ZCode

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: bbda81e4-adbf-4c45-b8ef-f36c1068acb6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request replaces hardcoded secrets and tokens with placeholder instructions in .env.example and README-PLATFORM.md to prevent credential exposure. It also introduces a new HTML audit document comparing Cal.com and Crove-Cal features. Feedback on the audit document highlights a mismatch between the summary card counts and the detailed table entries, which should be corrected for consistency.

[gemini-code-assist]

There is a mismatch between the summary cards and the actual counts in the detailed table below:

• The count of items with a partial/old version status (b-part) is 5 (Workflows 2.0, Troubleshooter 2.0, PBAC role overlays, Audit logs, Salesforce improvements), but the card shows 2.
• The count of items marked as not needed for the DOS use-case (KHÔNG CẦN priority) is 6 (Cal.ai, Cal Events, Cal Pay, Design system, Cal.com Agents, Salesforce improvements), but the card shows 4.

Updating these numbers will ensure the summary section is accurate and consistent with the detailed table.

Suggested change

	<div class="cards">
	<div class="card miss"><div class="num">12</div><div class="lbl">Tính năng fork CHƯA có</div></div>
	<div class="card warn"><div class="num">2</div><div class="lbl">Có một phần / bản cũ</div></div>
	<div class="card ok"><div class="num">4</div><div class="lbl">Không cần cho use-case DOS</div></div>
	<div class="card info"><div class="num">0</div><div class="lbl">Port được từ upstream (đã đóng source)</div></div>
	</div>
	<div class="cards">
	<div class="card miss"><div class="num">12</div><div class="lbl">Tính năng fork CHƯA có</div></div>
	<div class="card warn"><div class="num">5</div><div class="lbl">Có một phần / bản cũ</div></div>
	<div class="card ok"><div class="num">6</div><div class="lbl">Không cần cho use-case DOS</div></div>
	<div class="card info"><div class="num">0</div><div class="lbl">Port được từ upstream (đã đóng source)</div></div>
	</div>