docs: update README to reflect security hardening, config wiring, and dev/test setup changes

[man4ish]

What

Updates README.md to reflect the cumulative changes from PRs #9–#16, without touching sections that were already accurate. This is a documentation-only change — git diff --stat confirms README.md is the only file touched.

Changes and why

Configuration — new subsections for PR #10's config wiring:

• Added ## configs/repos.yaml under "Configuration": documents that it drives the repo list scripts/build_index.py indexes, and that it falls back to the same 19-repo hardcoded list if missing/empty/unparseable.
• Added ## configs/index_config.yaml under "Configuration": documents the llm_model key read by rag/engine.py (ollama_generate()'s default and RAGEngine.stream_llm()), with the same fallback-to-"llama3" behavior.
• Updated "Requirements → Generation Model" to drop the now-stale "hardcoded in rag/engine.py" wording in favor of pointing at the config file.
• Added a one-line cross-reference in "Supported Repositories" noting the list is now sourced from configs/repos.yaml.

Authentication — PR #14 and PR #15's fail-fast startup checks:

• Documented api/auth.py's validate_auth_config(): the app now refuses to start (raises at the FastAPI startup event) if AUTH_ENABLED=true and JWT_SECRET is unset/empty, closing the previous silent-bypass-via-empty-HMAC-secret issue.
• Documented the equivalent Docker-level check (PR fix: fail container startup when JWT_SECRET is unset instead of falling back to 'change-me' in nginx config #15): the container's CMD script exits before nginx/FastAPI start under the same condition, so devhub.conf's X-Devhub-Internal header is never generated with an empty/placeholder secret.

Running Tests — PR #13's frontend CI job:

• Noted that CI runs a separate Frontend Build & Test job (npm ci / npm run build / npm test) alongside the Python Lint & Test job. (No standalone "CI" section existed in the README, so this was folded into the existing "Running Tests" note added by PR chore: split dev/test dependencies into requirements-dev.txt #16 rather than creating a new top-level section.)

Chunking — stale limitation removed:

• processing/chunker.py already splits at paragraph/word boundaries (not a hard character slice) — confirmed by reading the current implementation. Replaced the "Chunker word-wrap (planned)" limitation with a "Resolved" note, and removed the now-done "Chunker word-boundary snapping" line from the V7 roadmap.
• Fixed a stray reference to "the hard character-slice in chunker.py" in the dedup/MIN_CHUNK_CHARS description.

Confirmed, not changed:

• "Install Dependencies" / "Running Tests" already correctly showed pip install -r requirements.txt (prod) vs. pip install -r requirements.txt -r requirements-dev.txt (dev/test) from PR chore: split dev/test dependencies into requirements-dev.txt #16 — verified against the actual current requirements.txt and requirements-dev.txt contents, left as-is.
• The main "Chunking strategy" description (under "Current Index Stats") already matched chunker.py's markdown-aware implementation — left as-is.

Verification

Every new claim was checked against the actual current file contents, not intended/assumed behavior:

• requirements.txt, requirements-dev.txt
• configs/repos.yaml, configs/index_config.yaml
• api/auth.py, api/main.py, Dockerfile
• processing/chunker.py, scripts/build_index.py
• .github/workflows/ci.yml

$ git diff --stat main
 README.md | 75 +++++++++++++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 67 insertions(+), 8 deletions(-)

---

🤖 Generated with Claude Code