Milestone 0: Astro Starlight documentation site

[devin-ai-integration]

Summary

Establishes the project's documentation site as the foundation for the
full STIG Manager re-implementation — it lands before any backend
or frontend code so the spec is the source of truth.

• docs/ — Astro Starlight workspace (TypeScript strict, standalone
  pnpm package).
• Information architecture mirrors the upstream readthedocs site:
  • Introduction (splash) — RMF context, "where to start" links.
  • Features — Overview, Common Tasks.
  • Installation & Setup — Overview, Quick Start (Docker), Database
    (Postgres 18), Authentication (OIDC), Environment Variables,
    Data & Permissions, Logging, Reverse Proxy, Hardening & TLS.
  • User Guide — Quick Start, Concepts & Workflow, Roles & Access,
    Review Handling, Rule Exceptions.
  • Admin Guide — Quick Start, Operations.
  • Reference — Overview + full OpenAPI v1 spec rendered inline via
    starlight-openapi. 174
    operation pages are auto-generated from the YAML.
  • The Project — Description, Architecture, Contributing, Testing,
    Related Repos, Roadmap, Examples, License & Intent.
• OpenAPI spec carried verbatim into docs/openapi/stig-manager.yaml
  from upstream so /api/v1 byte-compatibility is documented.
• Theme — shadcn-flavoured neutrals (src/styles/custom.css); dark
  mode auto by default with a manual selector.
• CI — .github/workflows/docs.yaml runs astro check and pnpm build on every PR; deploys to GitHub Pages on main (deploy step is
  optional / skipped on PRs).
• Repo root — README.md, LICENSE (MIT), .gitignore shaped for
  the multi-package repo (just docs/ for now; web/, api/ slots
  reserved for Milestone 1).

Stack adjustments from upstream that are reflected throughout the docs:

• MySQL → Postgres 18 (jsonb / timestamptz / uuid / pgcrypto + pg_trgm).
• Node/Express → Go binary (net/http + chi + oapi-codegen + sqlc).
• ExtJS → React 19 SPA (Vite + shadcn/ui + TanStack Router/Query/Table).
• Sphinx → Astro Starlight.

Local build is clean — 179 pages built in ~15 s with no warnings.

Screenshots

Homepage (dark mode):

OpenAPI reference (full list of operations rendered inline):

Review & Testing Checklist for Human

• Spot-check the IA — open the sidebar and verify each top-level
  section (Features → Installation & Setup → User Guide → Admin
  Guide → Reference → The Project) reads in the order you expect.
• Open /reference/api and click through a handful of operations to
  confirm request/response schemas render correctly (e.g.
  POST /collections, GET /collections/{id}/reviews,
  POST /stigs).
• Confirm the wording on /installation/database and
  /installation/environment-variables matches the Postgres 18 +
  Go-binary direction you want — those are the pages most likely to
  need follow-up wording tweaks.
• Review /project/roadmap and confirm the milestone ordering
  matches what you want for Milestones 1–16.
• Local: cd docs && pnpm install && pnpm dev, then open
  http://127.0.0.1:4321.
• GitHub Pages: to make the public site live after merge, enable
  Pages on the repo at Settings → Pages → Source: GitHub Actions.
  Until then the deploy preview / production job is intentionally
  skipped.

Notes

• Not included on purpose: the Go backend, React SPA, Dockerfile,
  docker-compose. Those come in Milestone 1 (next PR).
• Not included on purpose: my local PLAN.md planning scratch — the
  public roadmap lives at
  docs/src/content/docs/project/roadmap.mdx instead and is the
  canonical source for milestone status.
• No link check yet. I initially wired up linkinator but the site
  is built with an absolute site: URL, so every internal link is
  absolute and gets filtered out by the same regex that skips remote
  URLs (i.e. it would scan zero links). I'll add a proper link check in
  a follow-up — likely lychee against pnpm preview on a real local
  server, gated to a separate job.
• OpenAPI spec is the upstream v1 file as-is. Any feature divergence
  between this implementation and upstream will be tracked by editing
  the spec in a future milestone PR; we did not alter it in this
  one.
• License: the project itself is MIT; the OpenAPI spec, schema, and
  any forward-ported documentation language remain governed by
  upstream's LICENSE.md / INTENT.md.

Link to Devin session: https://app.devin.ai/sessions/022810763c4643c0848ba894c1512b92
Requested by: @Exonical

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring