docs: correct and tighten the README

[Bccorb]

What

An accuracy pass over the README, checked against the code rather than read for style.

The console contradiction

The scope section listed "Admin portal or dashboard UI" as managed-service-only, and the self-hosting notes claimed "No admin portal, billing, or managed infrastructure is included." Both contradicted the Docker quickstart 300 lines below, which tells you to sign up at /console. The image builds the dashboard SPA at a pinned release, and src/lib/adminDashboard.ts serves it unless SERVE_ADMIN_DASHBOARD=false, so it is on by default.

The console is now listed as included, with its own subsection covering the switch and the version-pinning model. The non-goals list names the multi-tenant control plane and hosted portal instead, so the self-hostable console and the managed portal read as two different products.

Five factual errors

• curl /health 404s. Only /health/status and /health/version are registered in src/routes/health.routes.ts. Both Docker sections were already correct; the local quickstart was the outlier, and it is the first command a new user runs.
• The documented migrations-only container run does not work. The image ENTRYPOINT is validateEnvs.sh, which never references "$@" and ends in exec npm run start, so docker run ... npm run migrate:up ignores the argument and starts a server. Migrations already run on every boot, so the step is unnecessary; it is now described as automatic.
• The nightly tag is never published. docker-publish.yml triggers only on v* tag pushes, and nightly is gated on enable={{is_default_branch}}, which is false for a tag ref. No other workflow publishes images. Removed from the advertised tags.
• The typed-client example pointed at an unpublished package. npm view seamless-auth-api returns 404. The example now generates types from the committed openapi.json and imports them locally.
• OWNER_EMAIL grants admin:write and admin, per src/lib/ownerAdmin.ts, not a bare admin role.

Also: Node 24 stated explicitly (the engines field requires >=24 <25) instead of "LTS recommended", the adapters linked by package name, and the license section corrected from "Seamless Auth Server" to "Seamless Auth API".

Structure

# Docker Quickstart was a second H1. "Notes for self-hosting" and "Production notes" each opened "For production deployments:" and repeated five of seven bullets. The OAuth provider JSON, lockout JSON, and scoped-role rules duplicated docs/oauth.md, docs/admin-operations.md, and docs/configuration.md.

Those become summaries linking to the existing pages, with a table of contents added. 530 lines to 430.

Verified

All internal links resolve, every env var named exists in .env.example and source, the DB defaults match, the compose override names are real, the dev-only gating of /docs and /openapi.json is accurate, the OpenAPI drift-test claim is true, and the security contact matches SECURITY.md. All 14 table-of-contents anchors and the four cross-doc anchors resolve. The openapi-typescript URL returns HTTP 200. The coverage-badge script's required exact line is preserved.

No changeset: docs: commits in this repo do not carry one.

Follow-ups not in this PR

• If nightly builds are wanted, docker-publish.yml needs a push: branches: [main] trigger. This PR documents current behavior rather than changing it.
• @seamless-auth/server is published at 0.0.0 from June 2025 while @seamless-auth/express is at 0.11.0, so the README routes integrators to the Express adapter. If server is meant to be the recommended path, it needs a real release.