docs: sweep the docs and comments against the current ecosystem

[Bccorb]

Swept the repository's documentation and comments for accuracy, then compressed what was repeated. Every cross-repo claim was checked against the current seamless-auth-api (0.7.4, including its OpenAPI document and .env.example), seamless-templates, the seamless-auth-server adapters, and seamless-auth-react.

Documentation that had gone stale

Where	Said	Actually
README local dev	npm run db:migrate	No such script. The auth API spells it migrate:up, and the Docker path runs it at container start
init --profile help	"Use that profile instead of the active one"	Accepted and ignored with a warning since managed connect moved to the portal session
README project tree	Lists a generated README.md	The CLI writes none. It does write seamless.config.json, and admin/ under --admin=source
README philosophy	"No redirects or third-party auth providers"	OAuth ships: Google, GitHub, Microsoft, GitLab, with redirect URIs
README included projects	Two repositories	Four. The adapters and the React SDK are what the generated api/ and web/ run on
verify compose header	One Express adapter, NODE_ENV=test, SEAMLESS_ADAPTER_DIR, .env.verify	Two adapters plus react; the file sets development twenty lines below; neither that variable nor that file exists
SEAMLESS_REACT_DIR (AGENTS.md, verify.ts)	The default web template source, used by CI	A single-template override. The default drives every registry web template, and CI sets SEAMLESS_TEMPLATES_DIR
config set help	String-typed keys	Missing session_idle_ttl

New

README sections for seamless check and seamless verify. Verify is half of what the CLI does per AGENTS.md and ships inside the package, but had no README coverage at all.

One real contract drift, now written down

WRITABLE_KEYS carries magic_link_redirect_uris and claimed to stay in step with the instance's strict patch schema. It does not: the API's PATCH /system-config/admin has 16 keys and not that one, the key is defined in @seamless-auth/types on an untagged commit, and the API's own magicLinkRedirect.ts says the dedicated allowlist still needs "a system config key that lives in @seamless-auth/types and a coordinated release". So config set magic_link_redirect_uris fails against every live instance today.

The key stays listed, since a released API will then accept it with no CLI change, but the comment and the AGENTS.md maintenance traps now say it is rejected rather than claiming the lists agree.

Dead config removed

The scaffold set AUTH_MODE=server in the auth server env and on the admin console container. Nothing reads it: not the auth API, not the admin dashboard (its entrypoint takes only API_URL), and not the web or api templates. Verified absent from the pinned .env.example the CLI fetches, so removing the write changes nothing but the noise. The tests now assert its absence.

Compression

Comment quality was already high, so this trims rather than rewrites:

• The --yes / --force rule was restated four times in init.ts. One canonical statement on InitOptions, short notes at each decision.
• An identical three-line rotation-ordering comment sat at both call sites. It moved onto the shared resolveDatabaseUrl.
• loginFlow.ts and templates.ts had comments written as diffs ("no longer", "this replaces"). They now describe the contract they document.

Also recorded in AGENTS.md, not changed here

• Pin drift, since bumping is a release call: SEAMLESS_AUTH_API_VERSION is v0.7.1 against v0.7.4 released, and SEAMLESS_TEMPLATES_REF is v0.9.0 against v0.11.0.
• --auth=local clones the auth API at its default branch while --auth=docker runs a pinned image, so the two modes can scaffold different servers from one CLI version.

Still open

Two TODO(#125) comments (init.ts, login.ts) point at a closed issue, so nothing tracks dropping those deprecation shims. AGENTS.md requires a live ticket. Happy to open one.

Checks

npm run build, npm test (977 passing, 4 skipped), and npm run coverage (99.38% lines) all pass.