chore: align VidcastX project status and security baseline

[devchaudhary24k]

Summary

• rewrite the project documentation around the repository's current, verified state
• classify VidcastX as an in-development, source-available proprietary platform experiment
• preserve the original IDEA.md body while clearly separating vision from implementation
• add a real local login screenshot and a current architecture diagram
• replace the stale TODO list with a prioritized, reality-based work queue
• restore tests as a root/CI gate and repair API test mocks that had drifted from the implementation
• refresh direct and transitive dependencies, move CI to Node 22 and pnpm 11, and clear the current audit findings
• align repository/security links and the local Redis port with the intended Pixelact Studio ownership

Why

The repository metadata and documentation contradicted one another: GitHub called the project open source, the README called it proprietary and production-ready, no license existed, and deployment was not codified. IDEA.md described a target system that had drifted from the checked-in monorepo, while TODO.md still listed already-started work and omitted more important release blockers.

CI also did not run the existing tests. The API test mocks had fallen behind newer controller imports, and the generated TanStack route tree caused the current dev branch's formatting gate to fail. Dependency automation had accumulated overlapping security PRs across different base branches.

Validation

• pnpm install --frozen-lockfile
• pnpm test — 24 tests pass (22 API, 2 app)
• pnpm check-types
• pnpm lint
• pnpm format
• pnpm lint:ws
• pnpm build
• pnpm audit --audit-level low — no known vulnerabilities
• root docs/config Prettier check
• git diff --check

Review notes

• The body of IDEA.md is intentionally preserved. Only its title and an implementation-boundary note changed.
• This PR chooses source-available proprietary licensing because the existing package metadata and README already indicated private/proprietary intent. Public repository visibility alone does not grant an open-source license.
• This PR does not claim that the full upload-to-transcode-to-playback flow or a production deployment has been verified. Those remain explicit TODO items.
• A real login-screen capture is included. An authenticated dashboard screenshot remains pending until the end-to-end environment can be exercised honestly.
• Once merged, this should supersede the overlapping dependency/security work in Bump next from 16.1.6 to 16.2.3 in the npm_and_yarn group across 1 directory #68, fix(deps): update dependency next to v16.2.6 [security] #74, chore(deps): update dependency better-auth to v1.6.13 [security] #75, chore(deps): update dependency turbo to v2.9.14 [security] #76, Bump the npm_and_yarn group across 2 directories with 2 updates #77, chore(deps): update dependency vitest to v3.2.6 [security] #78, Bump next from 16.1.6 to 16.2.6 in /packages/seo in the npm_and_yarn group across 1 directory #79, chore(deps): update dependency vite to v7.3.5 [security] #80, and chore(deps): update pnpm to v11 [security] #81. It does not replace the unrelated feature work in feat(transcoder): rewrite on libav (node-av) bindings #69 or the minimatch-major proposal in chore(deps): update dependency @types/minimatch to v6 #71.