[MaximumTrainer]

Brings the documentation back in line with the code after several rounds of change, and empties docs/issues.

The part that mattered most

user-guide.md told readers to set VITE_API_KEY, and the website's setup steps plus its React and Vue samples all sent an operator API key from the browser. That key maps to a full Operator principal and a bundler inlines it as a literal string — which is precisely the defect #90 removed. The docs were teaching people to reintroduce it.

Browser samples now start a session anonymously, carry the per-session applicant token, keep the renewal each submission returns, and handle a spent credential (401 expired / 403 session ended) as distinct from a retryable 5xx. The Node sample keeps its API key — it is server-side, where that is correct — with a note saying why.

All three samples also read data.nextNode, a field the API has never returned. They now read currentNode and isCompleted.

Other corrections, each checked against the code

Claim	Reality
SSE endpoint is /sessions/{id}/stream	It is /events (troubleshooting + components.md)
GET /auth/me	It is /api/auth/me
SessionTimeoutMinutes defaults to 60	It is 1440, in both appsettings.json and the code fallback — stated wrongly in four places
Container diagram has no message broker	RabbitMQ is required above a single replica; now in the diagram with its responsibilities
SPA described as one surface	It is a public applicant route plus operator routes behind SSO (#91)
docs/issues/ is "known gaps"	All sixteen were delivered and closed

Documented behaviour that previously had none

• Rate limits — partitioning, the 429 path, proxy configuration, per-instance semantics, and the shared-credential trap. Added to the user guide, the website (new Rate Limits section), and troubleshooting. The website documented no limits at all, though a 429 is now reachable on every endpoint.
• Applicant token lifetime — renewal on submission, expiry, and refusal once a session is terminal.
• Document session scoping — including why a foreign file id returns 404 rather than 403.
• The per-session analytics event trail — where it is, and how to read both empty states honestly.
• Running the broker-backed tests, and why CI sets REQUIRE_BROKER_TESTS=1.
• Multi-replica SSE as the first thing to check when events stop arriving — it fails silently, so it belongs near the top of that troubleshooting entry.

docs/issues emptied

All 16 files were delivered and their GitHub issues closed (#76–#86, #90–#95). Left in place they were a second, stale copy of requirements that no longer matched the code, and a reader could not tell which were outstanding. The README now explains what the directory is for, how to add an item, that the file should be deleted once delivered, and records what has passed through it. The creation workflow already exits cleanly on an empty directory.

Verification

Checked mechanically rather than by eye:

• Every relative link and heading anchor across all markdown resolves (0 broken) — this caught one anchor I had written wrong.
• All 36 documented config keys exist in the source.
• Every documented /api/... path matches a real controller route (27 routes cross-checked) — this caught the /stream and /auth/me errors.
• Both website pages parse with balanced, correctly nested tags — this caught a </section> I had misplaced.
• Every markdown table is well formed.
• Backend 354 passed / 3 skipped (broker tests; Docker down locally), frontend 175 passed.

One incidental fix: rebuilding website.css added 10 selectors and removed none. Those classes were already used in index.html markup but missing from the committed stylesheet, so the checked-in CSS was stale.

🤖 Generated with Claude Code