Harden the minimum complete Samebase starter

[nicu-chiciuc]

Why

samebase/app must be a small, complete app base. Guest auth, real-time todo data, QR sharing, shadcn UI, and the full Convex and Cloudflare path stay intact. Repository-only history and unsafe deployment options do not belong in repositories created from the template.

The deployment helper must also keep the Samebase-connected Worker name authoritative and keep dry runs outside Convex deployment work.

What changed

• Preserve the complete example and state this purpose in the README.
• Reject Worker name overrides and Wrangler option terminators that can hide a dry-run flag.
• Keep local dry runs on the application-only build path, including --dry-run=true.
• Compare manual Workers Builds with the checked-out Git commit instead of trusting the provider commit variable.
• Enable strict TypeScript and the agreed low-friction checks across browser, Node, and Convex code.
• Add package license metadata, ignore local secret and Convex state files, and make security links portable.
• Remove repository construction history and completed package-import research.

Verification

• vp run check
• vp run build
• vp run deploy:dry-run
• vp run deploy:preview:dry-run
• 23 tests pass
• Independent review found no remaining actionable issue

Follow-up

Manual email and password provisioning stays separate. The current Convex Auth version requires a sign-in-only password gate, internal provisioning, password replacement with session invalidation, and integration tests. Adding the provider alone would expose public password sign-up.

First Message

I still need to have at least something that shows abilities. We would expect a base that could extend to real, scalable, production-ready apps.

Requested Codex Runtime

Codex desktop, default task runtime.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}