feat(starter): add Tuurio AI SaaS product template

[kraus-it]

Summary

• add a polished Next.js 16 multi-tenant AI SaaS product starter as a separate product, not one of the 20 framework satellites
• implement Tuurio ID public-client OIDC, exact-origin configuration, server JWT validation, tenant-scoped Postgres/memory persistence, streaming AI adapters, quotas, rate limits, audit, admin, deletion, and explicit demo states
• extend the distribution catalog and sync tooling to manage 20 satellites plus one product repository
• add product screenshots, agent guidance, CI, browser E2E, Postgres integration coverage, and clean-room packaging

Verification

• npm run typecheck
• npm test — 11 unit tests; 12 with disposable Postgres
• npm run build
• npm run test:e2e — 2 Chromium tests
• Node 24 Docker clean-room: npm ci && npm run typecheck && npm test && npm run build
• Postgres 17 Docker integration: tenant isolation and atomic quota enforcement
• distribution: 22/22 tests and catalog validation
• actionlint 1.7.7 in Docker

Stack

This PR is intentionally based on #19 and remains open until the stacked slices are reviewed.

[kraus-it]

@claude Please review this stacked Slice 6 for security boundaries, tenant isolation, OIDC correctness, distribution behavior, and production readiness.

[kraus-it]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[kraus-it]

Public template verification completed: https://github.com/Tuurio/ai-saas-starter

Verified from a fresh clone with Node.js 24: npm ci, typecheck, unit tests, and production build all pass. The source distribution also passes 22/22 catalog tests, catalog validation, PostgreSQL integration testing, Playwright E2E, Docker clean-room packaging, and actionlint. The repository is public, Apache-2.0 licensed, marked as a GitHub template, and synchronized from source commit b744aa21520cb48d5588228a6f9d2fb22f598c9f.

PR remains open and draft as requested.

[kraus-it]

@claude Please review the current head of this PR. Focus on correctness, security, distribution/sync behavior, reproducibility, and tests. Report only actionable findings; if clean, state that explicitly.

[kraus-it]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[kraus-it]

Review follow-up complete on current head 1b7f638.\n\nLocal Claude review findings were fixed in fe9d9c7: bounded LRU request limiting, authenticated public-config delivery, bounded storage reads, complete usage rollback before streaming, abort-safe reservation handling, discovery timeout/cache bounds, CSP, and expanded memory/Postgres/E2E security tests. The static-rendering CSP tradeoff is documented in next.config.ts. All upstream Slice 3-5 review fixes are merged through this stacked branch.\n\nVerification: Node 24.11 typecheck, 13 unit tests, production Next build, real PostgreSQL integration tests, 3 Playwright E2E tests, 22/22 distribution tests, actionlint, and diff checks pass. The PR remains open and draft as requested.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.