chore: Consolidate project structure and update build configuration

.dockerignore

@@ -1,27 +1,37 @@
-**/.mount
-**/.classpath
-**/.dockerignore
-**/.env
-**/.git
-**/.gitignore
-**/.project
-**/.settings
-**/.toolstarget
-**/.vs
-**/.vscode
-**/*.*proj.user
-**/*.dbmdl
-**/*.jfm
-**/azds.yaml
-**/bin
-**/charts
-**/docker-compose*
-**/Dockerfile*
-**/node_modules
-**/npm-debug.log
-**/obj
-**/secrets.dev.yaml
-**/values.dev.yaml
-LICENSE
-README.md
-auth.conf
+# .NET build artifacts
+**/bin/
+**/obj/
+**/out/
+.artifacts/
+**/.artifacts/
+
+# Visual Studio / VS Code
+.vs/
+.vscode/
+*.user
+*.suo
+*.userosscache
+*.sln.docstates
+
+# Test results
+TestResults/
+**/TestResults/
+
+# NuGet packages
+*.nupkg
+*.snupkg
+packages/
+
+# Git
+.git/
+.gitignore
+.gitattributes
+
+# CI/CD
+.github/
+.codex
+
+# Other
+*.log
+*.tmp
+*.cache

.editorconfig

@@ -8,7 +8,7 @@
 # https://github.com/dotnet/runtime/blob/main/.editorconfig
 
 # https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-format
-# dotnet format style --verify-no-changes --severity=info --verbosity=detailed --exclude-diagnostics=IDE0055
+# dotnet format style --verify-no-changes --severity=info --verbosity=detailed
 
 # Root config
 root = true
@@ -22,7 +22,7 @@ insert_final_newline = true
 trim_trailing_whitespace = true
 
 # Markdown files
-[*.{md}]
+[*.md]
 end_of_line = crlf
 trim_trailing_whitespace = false
 
@@ -39,7 +39,6 @@ indent_size = 2
 # Json files
 [*.json]
 end_of_line = crlf
-indent_size = 4
 
 # Linux scripts
 [*.sh]
@@ -54,6 +53,29 @@ end_of_line = crlf
 end_of_line = crlf
 dotnet_diagnostic.IDE0055.severity = none
 dotnet_analyzer_diagnostic.severity = suggestion
+
+# Public API surface rules: not applicable, this is a console app not a reusable library
+dotnet_diagnostic.CA1002.severity = none  # Do not expose List<T>
+dotnet_diagnostic.CA1024.severity = none  # Use properties where appropriate
+dotnet_diagnostic.CA1034.severity = none  # Nested types should not be visible
+dotnet_diagnostic.CA1052.severity = none  # Static holder types (builder pattern uses partial classes)
+dotnet_diagnostic.CA1055.severity = none  # URI return values should not be strings
+dotnet_diagnostic.CA1056.severity = none  # URI properties should not be strings
+dotnet_diagnostic.CA1062.severity = none  # Validate parameters of public methods
+dotnet_diagnostic.CA1515.severity = none  # Consider making public types internal
+dotnet_diagnostic.CA1724.severity = none  # Type names should not match namespaces
+dotnet_diagnostic.CA2227.severity = none  # Collection properties should be read only
+
+# Console app context: no localization, no SynchronizationContext, intentional case usage
+dotnet_diagnostic.CA1303.severity = none  # Do not pass literals as localized parameters
+dotnet_diagnostic.CA1307.severity = none  # Specify StringComparison for clarity
+dotnet_diagnostic.CA1308.severity = none  # Normalize strings to uppercase (code intentionally lowercases)
+dotnet_diagnostic.CA2007.severity = none  # ConfigureAwait (console app has no SynchronizationContext)
+dotnet_diagnostic.CA2234.severity = none  # Pass System.Uri instead of string
+
+# False positives or inapplicable in this codebase
+dotnet_diagnostic.CA1508.severity = none  # Dead code (false positive with ??= pattern)
+dotnet_diagnostic.CA5392.severity = none  # DefaultDllImportSearchPaths (limited intentional P/Invoke, risk accepted)
 csharp_indent_block_contents = true
 csharp_indent_braces = false
 csharp_indent_case_contents = true
@@ -73,7 +95,7 @@ csharp_prefer_simple_using_statement = true
 csharp_prefer_static_anonymous_function = true
 csharp_prefer_static_local_function = true
 csharp_prefer_system_threading_lock = true
-csharp_preferred_modifier_order = public,private,protected,internal,file,static,extern,new,virtual,abstract,sealed,override,readonly,unsafe,required,volatile,async
+csharp_preferred_modifier_order = public,private,protected,internal,file,static,abstract,sealed,virtual,override,readonly,unsafe,volatile,async,extern,new,partial:warning
 csharp_preserve_single_line_blocks = true
 csharp_preserve_single_line_statements = false
 csharp_space_after_cast = false
@@ -204,3 +226,9 @@ dotnet_style_qualification_for_method = false
 dotnet_style_qualification_for_property = false
 dotnet_style_readonly_field = true
 dotnet_style_require_accessibility_modifiers = for_non_interface_members
+
+# ReSharper settings
+resharper_csharp_trailing_comma_in_multiline_lists = true
+resharper_csharp_var_for_built_in_types = false
+resharper_csharp_var_when_type_is_apparent = false
+resharper_csharp_var_when_type_is_not_apparent = false

.github/copilot-instructions.md

@@ -215,6 +215,13 @@ Parser design patterns:
 - Logging: Serilog with thread IDs (`Log.Information/Warning/Error`)
 - Exception handling: Currently uses broad `catch(Exception)` - TODO to specialize
 - Global usings: `GlobalUsing.cs` defines project-wide type aliases (`ConfigFileJsonSchema`, `SidecarFileJsonSchema`)
+- `Directory.Build.props`: Common MSBuild properties (`TargetFramework`, `Nullable`, `ImplicitUsings`,
+  `AnalysisLevel`, etc.) shared across all projects live here at the solution root. Do not duplicate
+  these in individual `.csproj` files -- only add a property to a `.csproj` when it is project-specific
+  or overrides the shared default.
+- `Directory.Packages.props`: All NuGet package versions are centralised here via `PackageVersion` items.
+  `PackageReference` elements in `.csproj` files must not include a `Version` attribute. Asset metadata
+  (`PrivateAssets`, `IncludeAssets`) stays in the `.csproj` `PackageReference` element.
 
 ### Naming and Structure
 
@@ -281,15 +288,15 @@ dotnet husky run
 
 ### GitHub Actions
 
-- **BuildGitHubRelease.yml**: Multi-runtime matrix build (win, linux, osx × x64/arm/arm64)
-- **BuildDockerPush.yml**: Multi-arch Docker builds (linux/amd64, linux/arm64)
-- **TestBuildPr.yml** / **TestDockerPr.yml**: PR validation
+- **publish-release.yml**: Multi-runtime matrix build (win, linux, osx x x64/arm/arm64)
+- **publish-periodic-docker-release.yml**: Multi-arch Docker builds (linux/amd64, linux/arm64)
+- **test-pull-request.yml**: PR validation
 - Version info: `version.json` with Nerdbank.GitVersioning format
 - Branches: `main` (stable releases), `develop` (pre-releases)
 
 ### Docker
 
-- Multi-stage builds in `Docker/Ubuntu.Rolling.Dockerfile`
+- Multi-stage builds in `Docker/Dockerfile`
 - Base image: `ubuntu:rolling` only (no longer publishing Alpine or Debian variants)
 - Supported architectures: `linux/amd64`, `linux/arm64` (no longer supporting `linux/arm/v7`)
 - Tool installation: Ubuntu package manager (apt)
@@ -440,3 +447,12 @@ Check states with `HasFlag()`, combine with `|=`
 - **KeepAwake.cs**: System sleep prevention
 - **PlexCleaner.defaults.json**: Canonical configuration reference
 - **.editorconfig** / **.csharpier.json**: Code style definitions
+
+## Git and Commit Rules
+
+**These rules are absolute — no exceptions:**
+
+- **Never make git commits.** All commits must be cryptographically signed (SSH/GPG). AI coding agents cannot produce signed commits. Stage changes with `git add` and leave `git commit` to the developer, who must run it in their own environment where signing keys are available.
+- **Never force push.** Do not run `git push --force` or `git push --force-with-lease`. Force pushing rewrites shared branch history and is blocked by branch protection rules.
+- **Never run destructive git commands** (`git reset --hard`, `git checkout .`, `git restore .`, `git clean -f`) without explicit developer instruction.
+- **Staging is the limit.** Prepare changes and stage files; the developer handles all commits and pushes.

.github/dependabot.yml

@@ -1,43 +1,23 @@
-# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-version: 2
-updates:
-
-  # main
-- package-ecosystem: "nuget"
-  target-branch: "main"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    nuget-deps:
-      patterns:
-        - "*"
-- package-ecosystem: "github-actions"
-  target-branch: "main"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    actions-deps:
-      patterns:
-        - "*"
-
-  # develop
-- package-ecosystem: "nuget"
-  target-branch: "develop"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    nuget-deps:
-      patterns:
-        - "*"
-- package-ecosystem: "github-actions"
-  target-branch: "develop"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    actions-deps:
-      patterns:
-        - "*"
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+version: 2
+updates:
+
+  # main
+- package-ecosystem: "nuget"
+  target-branch: "main"
+  directory: "/"
+  schedule:
+    interval: "daily"
+  groups:
+    nuget-deps:
+      patterns:
+        - "*"
+- package-ecosystem: "github-actions"
+  target-branch: "main"
+  directory: "/"
+  schedule:
+    interval: "daily"
+  groups:
+    actions-deps:
+      patterns:
+        - "*"