feat: complete UnitFlow application and quality hardening

.env.example

@@ -0,0 +1,5 @@
+# UnitFlow static conversions require no environment variables.
+# Add placeholder-only variables here if an optional online integration is introduced.
+# Never commit real API keys, tokens, signing secrets, or private endpoints.
+
+UNITFLOW_LOG_LEVEL=info

.github/FUNDING.yml

@@ -0,0 +1,2 @@
+custom:
+  - "https://buymeacoffee.com/sanskarIN"

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,68 @@
+name: Bug report
+description: Report a reproducible defect in UnitFlow
+title: "bug: "
+labels: [bug, triage]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a problem. Remove secrets and personal data from logs before submitting.
+  - type: input
+    id: version
+    attributes:
+      label: UnitFlow version or commit
+      placeholder: v0.1.0-alpha.1 or commit SHA
+    validations:
+      required: true
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      options:
+        - Android
+        - Windows
+        - Linux
+        - macOS
+        - Web
+        - iOS
+        - Rust core only
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: Describe the observed behavior and what you expected instead.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction steps
+      placeholder: |
+        1. Open ...
+        2. Select ...
+        3. Enter ...
+        4. Observe ...
+    validations:
+      required: true
+  - type: textarea
+    id: conversion
+    attributes:
+      label: Conversion details
+      description: For conversion defects, include exact input, source/target units, notation, rounding, and locale.
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant non-sensitive logs
+      render: shell
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checklist
+      options:
+        - label: I searched existing issues for duplicates.
+          required: true
+        - label: I removed credentials, tokens, private data, and signing material.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Private security report
+    url: mailto:sanskarin@outlook.in?subject=UnitFlow%20Security
+    about: Report suspected vulnerabilities privately instead of opening a public issue.
+  - name: General support
+    url: mailto:supportramsandesh@gmail.com?subject=UnitFlow%20Support
+    about: Use private support when an issue would require sharing non-public details.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,53 @@
+name: Feature request
+description: Propose a coherent improvement to UnitFlow
+title: "feat: "
+labels: [enhancement, triage]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or opportunity
+      description: What user need would this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed experience
+      description: Describe the desired behavior without prescribing unnecessary implementation details.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Conversion engine
+        - Unit catalog
+        - Custom units
+        - Converter UI
+        - Search/library
+        - Favorites/history/pins
+        - Import/export
+        - Accessibility
+        - Performance
+        - Platform integration
+        - Documentation
+        - Other
+    validations:
+      required: true
+  - type: checkboxes
+    id: principles
+    attributes:
+      label: Product principles
+      options:
+        - label: This keeps core static conversion usable offline.
+          required: true
+        - label: This does not require an intrusive donation or sign-in flow.
+          required: true
+        - label: I searched existing issues for similar requests.
+          required: true

.github/dependabot.yml

@@ -0,0 +1,28 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+
+  - package-ecosystem: pub
+    directory: /apps/unitflow_app
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(ci)"

.github/pull_request_template.md

@@ -0,0 +1,27 @@
+## What changed
+
+Describe the user-visible or engineering change and why it is needed.
+
+## Verification
+
+- [ ] `cargo fmt --all -- --check`
+- [ ] `cargo clippy --workspace --all-targets --all-features -- -D warnings`
+- [ ] `cargo test --workspace --all-features`
+- [ ] `flutter analyze --fatal-infos --fatal-warnings`
+- [ ] `flutter test`
+- [ ] Relevant manual journey checked where automation is insufficient
+
+If a check is not applicable or could not run, explain why instead of marking it complete.
+
+## Quality checklist
+
+- [ ] Tests cover behavior changes or the reason they are unnecessary is documented.
+- [ ] No secrets, credentials, signing keys, private endpoints, or real user data were added.
+- [ ] Accessibility and keyboard/touch behavior were considered for UI changes.
+- [ ] Static conversion remains offline-capable.
+- [ ] Documentation and `what_changed.md` are updated when needed.
+- [ ] Backward compatibility/migration impact is documented.
+
+## Screenshots / recordings
+
+Add UI evidence for visual changes when useful. Do not include private user data.

.github/workflows/ci.yml

@@ -15,12 +15,41 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  repository-safety:
+    name: Repository safety
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Validate shell script syntax
+        run: bash -n tool/*.sh
+
+      - name: Validate Python utility syntax
+        run: python3 -m py_compile tool/*.py
+
+      - name: Test repository utilities
+        working-directory: tool
+        run: python3 -m unittest discover -p 'test_*.py'
+
+      - name: Verify version consistency
+        run: python3 tool/check_versions.py
+
+      - name: Scan tracked files for credential signatures
+        run: python3 tool/check_secrets.py
+
+      - name: Validate JSON and ARB syntax
+        run: python3 tool/check_data_files.py
+
+      - name: Verify internal Markdown links
+        run: python3 tool/check_docs_links.py
+
   rust:
     name: Rust quality
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -47,7 +76,7 @@ jobs:
         working-directory: apps/unitflow_app
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Flutter
         uses: subosito/flutter-action@v2
@@ -58,6 +87,9 @@ jobs:
       - name: Resolve dependencies
         run: flutter pub get
 
+      - name: Generate localizations
+        run: flutter gen-l10n
+
       - name: Verify formatting
         run: dart format --output=none --set-exit-if-changed lib test
 
@@ -66,3 +98,48 @@ jobs:
 
       - name: Test
         run: flutter test
+
+  bridge:
+    name: Rust Flutter bridge
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+          cache: true
+
+      - name: Resolve Flutter dependencies
+        working-directory: apps/unitflow_app
+        run: flutter pub get
+
+      - name: Install bridge generator
+        run: cargo install flutter_rust_bridge_codegen --version 2.12.0 --locked
+
+      - name: Bootstrap Flutter platform shells
+        run: bash tool/bootstrap_platforms.sh
+
+      - name: Integrate native bridge and generate bindings
+        run: bash tool/integrate_native_bridge.sh
+
+      - name: Verify generated Rust
+        run: cargo check --workspace --all-features
+
+      - name: Verify generated Dart
+        working-directory: apps/unitflow_app
+        run: flutter analyze --fatal-infos --fatal-warnings
+
+      - name: Verify generated integration is committed
+        shell: bash
+        run: |
+          if [[ -n "$(git status --porcelain --untracked-files=all)" ]]; then
+            echo "Generated bridge/platform integration differs from committed source." >&2
+            git status --short >&2
+            exit 1
+          fi

.github/workflows/codeql.yml

@@ -0,0 +1,38 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze Rust
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: rust
+          build-mode: none
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:rust"

.github/workflows/dependency-review.yml

@@ -0,0 +1,20 @@
+name: Dependency review
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@v5
+        with:
+          fail-on-severity: moderate