feat: open-source release prep, audit fixes, and deploy hardening

Production deploy completed (DigitalOcean Droplet, self-hosted Supabase,
Caddy + Let's Encrypt, GitHub Actions auto-deploy on push to main, daily
pg_dumpall backups). This commit lands the work that came out of the
deep audit pass and the open-source release prep.

Audit fixes:
- Webhook signing secret is now displayed in the settings UI with
  show/hide and copy-to-clipboard; the broken external docs.hackerspace.sh
  link is replaced with a link to the new local docs.
- Settings updateSpaceSettings parameter type now includes
  mission_statement so the field persists.
- members page enforces member_directory_visibility for non-admin viewers
  (admin_only, board_visible, members_visible).
- Mobile responsiveness pass: Projects Kanban grid, Members + Payments
  tables (column hiding on small screens), Proposal tally + voting
  buttons (2-col on mobile).

Open-source release scaffolding:
- LICENSE (MIT).
- CONTRIBUTING.md with dev setup, conventions, PR flow.
- SECURITY.md with disclosure policy.
- CHANGELOG.md.
- docs/WEBHOOKS.md with Node and Python signature verification examples.
- README.md rewritten for an open-source audience.

Removed v0/Vercel references:
- @vercel/analytics dependency removed.
- app/layout.tsx no longer imports Analytics, drops generator: 'v0.app'.
- Canonical deployment docs (docs/DEPLOYMENT.md, docs/README.md,
  docs/ARCHITECTURE.md, DATABASE.md, CLAUDE.md, README.md) now describe
  the self-hosted Droplet target only.
- e2e console-error check no longer filters [v0] noise.

Landing page:
- GitHub icon link to the public repo in the nav and footer.

app/(app)/members/page.tsx

@@ -1,6 +1,12 @@
 import { createClient } from '@/lib/supabase/server'
 import { MembersClient } from './members-client'
 
+// member_directory_visibility values come from space settings:
+//   admin_only       — only admins see the directory
+//   board_visible    — admins + board + treasurer see the directory
+//   members_visible  — every member of the space sees the directory (default)
+const ELEVATED_ROLES = new Set(['admin', 'board', 'treasurer'])
+
 export default async function MembersPage() {
   const supabase = await createClient()
   const { data: { user } } = await supabase.auth.getUser()
@@ -15,6 +21,36 @@ export default async function MembersPage() {
 
   if (!self) return null
 
+  const { data: space } = await supabase
+    .from('spaces')
+    .select('member_directory_visibility')
+    .eq('id', self.space_id)
+    .single()
+
+  const visibility = space?.member_directory_visibility ?? 'members_visible'
+  const isAdmin = self.role === 'admin'
+  const isElevated = ELEVATED_ROLES.has(self.role)
+
+  const allowed =
+    visibility === 'members_visible' ||
+    (visibility === 'board_visible' && isElevated) ||
+    (visibility === 'admin_only' && isAdmin)
+
+  if (!allowed) {
+    return (
+      <div className="p-8 max-w-2xl">
+        <h1 className="font-mono text-sm tracking-widest uppercase text-muted-foreground mb-3">Members</h1>
+        <div className="bg-card border border-border rounded p-6">
+          <p className="font-sans text-sm text-foreground mb-2">The member directory is restricted in this space.</p>
+          <p className="font-sans text-sm text-muted-foreground">
+            A space admin has set member directory visibility to <code className="font-mono text-xs px-1 py-0.5 bg-muted rounded">{visibility}</code>.
+            Contact an admin if you need access.
+          </p>
+        </div>
+      </div>
+    )
+  }
+
   const { data: members } = await supabase
     .from('space_members')
     .select('*')