[P3] Audit: Self-hosting documentation is not prominent enough

[baixiangcpp]

Imported from the byteflow.tools deep audit on 2026-06-22.

Problem: byteflow.tools is open source and privacy-first, but users who want to run it internally need a clear self-hosting path. Self-hosting is especially relevant for teams that cannot paste internal payloads into public sites even when processing is local.

Affected pages:

• About
• Pricing
• Trust Center
• GitHub README
• Install App

Reproduction steps:

1. Open About, Pricing, Trust Center, and GitHub README.
2. Look for a “self-host” guide.
3. Check whether Docker, environment variables, build steps, deployment targets, and update guidance are documented.

Expected behavior: self-hosting should be discoverable from product pages and GitHub.

Actual behavior: open-source status is visible, but self-hosting guidance is not prominent enough.

Impact: teams with strict internal policies may not adopt the project.

Proposed fix:

• Add a Self-hosting guide.
• Link it from Pricing, About, Trust Center, and README.
• Document local build, Docker deployment, static hosting, update strategy, and security headers.
• Explain which features require external network access.

Acceptance criteria:

• A self-hosting guide exists and is linked from core trust/commercial pages.
• A new user can deploy the app from the guide.
• External-request and analytics behavior are documented for self-host deployments.

[baixiangcpp]

Closed as completed by the canonical BF audit backlog work. This older non-BF audit issue duplicates work now merged through PRs #209-#219, with the BF issues closed and guard/test coverage in place. The remaining non-duplicate follow-up is #7, which stays open because the upstream Next/PostCSS advisory is not fixed yet.