init: project structure, .gitignore, .env.example, runners.conf.example

- .gitignore: excludes .env, runners.conf, certs, temp files, editor files
- .env.example: all configuration variables with sections and descriptions
- runners.conf.example: dynamic runner definition format (pipe-delimited)
- PLAN.md: comprehensive implementation plan with DoD for all 18 milestones
- CLAUDE.md: project conventions and instructions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -0,0 +1,46 @@
+# Gitea Migration Toolkit
+
+## Project Overview
+Bash-based automation toolkit for migrating 3 GitHub repos to self-hosted Gitea. All scripts run from MacBook, SSHing into Unraid (primary) and Fedora (backup mirror). GitHub serves as offsite push mirror.
+
+## Architecture
+- **Control plane**: MacBook runs all scripts locally, SSHs into remotes
+- **Primary Gitea**: Docker Compose on Unraid
+- **Backup Gitea**: Docker Compose on Fedora (pull mirrors)
+- **Runners**: Docker on Unraid/Fedora, native binary + launchd on MacBook
+- **HTTPS**: Nginx reverse proxy + Certbot on Unraid
+
+## Script Conventions
+- All `.sh` files MUST start with `set -euo pipefail`
+- All scripts source `lib/common.sh` for shared functions
+- All scripts MUST pass `shellcheck` with zero warnings
+- All scripts MUST pass `bash -n` syntax check
+- Configuration via `.env` file (never hardcode values)
+- Templates use `.tpl` extension and `envsubst` for rendering
+- Every phase has: main script + post_check + teardown
+
+## Idempotency
+Every create/deploy operation checks state first and skips if already done. Running any script twice produces the same result with no errors.
+
+## File Structure
+```
+.env.example          # Template — copy to .env and fill in
+runners.conf.example  # Template — copy to runners.conf
+lib/common.sh         # Shared functions (source this in every script)
+setup/                # Machine setup + .env wizard
+templates/            # Config templates (.tpl files)
+contracts/            # API endpoint documentation
+backup/               # Backup and restore scripts
+```
+
+## Key Commands
+- `setup/configure_env.sh` — Interactive .env setup wizard
+- `preflight.sh` — Validate everything before running phases
+- `run_all.sh` — Execute all phases sequentially
+- `teardown_all.sh` — Reverse teardown
+- `manage_runner.sh add|remove|list` — Dynamic runner management
+
+## Sensitive Files (never commit)
+- `.env` — contains passwords, tokens, IPs
+- `runners.conf` — contains server IPs and paths
+- `*.pem`, `*.key`, `*.crt` — SSL certificates