docs: add initial docs/ information architecture + stubs

docs/reference/api.md

@@ -0,0 +1,10 @@
+# API notes
+
+- Backend defaults to http://localhost:8000
+- Health endpoints:
+  - `/health`
+  - `/healthz`
+  - `/readyz`
+
+> **Note**
+> Add canonical API docs strategy here (OpenAPI, versioning, examples).

docs/reference/authentication.md

@@ -0,0 +1,30 @@
+# Authentication
+
+Mission Control supports two auth modes via `AUTH_MODE`:
+
+- `local`: shared bearer token auth for self-hosted deployments
+- `clerk`: Clerk JWT auth
+
+## Local mode
+
+Backend:
+
+- `AUTH_MODE=local`
+- `LOCAL_AUTH_TOKEN=<token>`
+
+Frontend:
+
+- `NEXT_PUBLIC_AUTH_MODE=local`
+- Provide the token via the login UI.
+
+## Clerk mode
+
+Backend:
+
+- `AUTH_MODE=clerk`
+- `CLERK_SECRET_KEY=<secret>`
+
+Frontend:
+
+- `NEXT_PUBLIC_AUTH_MODE=clerk`
+- `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=<key>`

docs/reference/configuration.md

@@ -0,0 +1,19 @@
+# Configuration reference
+
+This page collects the most important config values.
+
+## Root `.env` (Compose)
+
+See `.env.example` for defaults and required values.
+
+### `NEXT_PUBLIC_API_URL`
+
+- **Where set:** `.env` (frontend container environment)
+- **Purpose:** Public URL the browser uses to call the backend.
+- **Gotcha:** Must be reachable from the *browser* (host), not a Docker network alias.
+
+### `LOCAL_AUTH_TOKEN`
+
+- **Where set:** `.env` (backend)
+- **When required:** `AUTH_MODE=local`
+- **Policy:** Must be non-placeholder and at least 50 characters.