docs: detailed README with features, architecture, and code review notes

[devin-ai-integration]

Summary

Replaces the existing README.md with a much more detailed version. Documentation-only change — no source code is touched.

The new README adds:

• Table of contents with deep-linked sections.
• Architecture diagram (ASCII) showing the SPA → Express API → Sequelize/SQLite flow.
• Tech stack tables for both backend/ and frontend/ derived from their package.json files.
• Features reorganized into Auth / Admin / User / Assessment groups (consolidated from the previous checkbox list).
• Project structure tree covering backend/, frontend/, amplify/, data/, dokumen/, and migrations/.
• Getting Started with both monorepo (npm run dev) and per-app workflows.
• Environment variables expanded to include JWT_SECRET, Google OAuth, AWS S3, and SMTP keys (in addition to the previously documented SESSION_SECRET, DATABASE_URL, FRONTEND_URL).
• API surface table mapping /api/auth, /api/users, /api/courses, /api/admin, /api/health to their route files.
• Frontend routes table derived from frontend/src/App.jsx, including the admin sub-tree and the ProfileCompletionGuard.
• Certificate generation notes (current static PDF behavior + planned dynamic generation).
• Deployment section covering the AWS Amplify config and the backend Dockerfile.
• Code Review Notes — 10 opinionated observations about the codebase (verbose console.log in app.js, hard-coded CORS list, self-referential package.json entries, MIGRATION_TIMESTAMP_* files, OAuth-token-in-URL pattern, heavy frontend deps, sparse tests, etc.).

Review & Testing Checklist for Human

• Sanity-check the Code Review Notes section — these are opinions based on a quick read of the codebase. Confirm any items you don't want surfaced publicly (e.g., the OAuth/localStorage security comment, the "All Rights Reserved" license line, or the MIGRATION_TIMESTAMP_* rename suggestion) before merging.
• Verify the port numbers in the "Running locally" section. The README says the backend defaults to 5000 (from backend/app.js) but the frontend package.json has "proxy": "http://localhost:3001". If the backend actually runs on 3001 in your setup, the README's PORT=5000 example will be misleading.
• Verify the Frontend Routes table still matches frontend/src/App.jsx (I generated it from the current file, but it's worth a glance to catch any routes I missed).
• Confirm that the default credentials (1@teraplus.com / AdminPass456) are still safe to publish in the README — they're in the repo already via dokumen/credentials.txt but worth a deliberate sign-off.

Notes

• This is a pure docs change; no build/lint/test commands were run since nothing in the runtime tree changed.
• The previous README's content is preserved in spirit (features, setup, certificate notes, default credentials) — nothing was dropped, only expanded.
• This is the first of 7 README PRs across your repos as requested.

Link to Devin session: https://app.devin.ai/sessions/b6d57fcc0a8e415a948086eff4230f08
Requested by: @zXmill

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring