docs: point doc links at the live GitHub Pages site

.github/CODEOWNERS

@@ -20,3 +20,77 @@
 /scripts/ci/large_file_ratchet.py                      @cloudQuant
 /scripts/ci/mypy_ratchet.py                            @cloudQuant
 /scripts/ci/npm_audit_ratchet.py                       @cloudQuant
+
+# Iteration 195 governance coverage. D2 confirms @cloudQuant is the only
+# currently verified GitHub owner. Rules remain broad-to-narrow so later
+# domain owners can be added without replacing the ratchet baseline above.
+
+# Broad repository control planes
+/.github/**                                                  @cloudQuant
+/scripts/ci/**                                               @cloudQuant
+/src/backend/app/**                                          @cloudQuant
+/src/frontend/src/**                                         @cloudQuant
+/src/bt_api_py/**                                            @cloudQuant
+/docker/**                                                   @cloudQuant
+/Dockerfile*                                                 @cloudQuant
+/src/backend/Dockerfile                                      @cloudQuant
+/src/frontend/Dockerfile                                     @cloudQuant
+/scripts/ops/release.sh                                      @cloudQuant
+/scripts/ops/docker_deploy.sh                                @cloudQuant
+/scripts/ops/deploy_server.sh                                @cloudQuant
+/scripts/ops/generate_lockfiles.sh                           @cloudQuant
+/scripts/ops/validate_docker_env.py                          @cloudQuant
+/pyproject.toml                                              @cloudQuant
+/uv.lock                                                     @cloudQuant
+/config/*.lock                                               @cloudQuant
+/**/package.json                                             @cloudQuant
+/**/pyproject.toml                                           @cloudQuant
+/**/.env.example                                             @cloudQuant
+/.env.example                                                @cloudQuant
+/src/backend/pyproject.toml                                  @cloudQuant
+/src/backend/requirements.txt                                @cloudQuant
+/docs/requirements.txt                                       @cloudQuant
+/tests/e2e/requirements.txt                                  @cloudQuant
+/src/backend/package-lock.json                               @cloudQuant
+/src/frontend/package-lock.json                              @cloudQuant
+**/SECURITY.md                                               @cloudQuant
+
+# Narrow R2/R3 domains
+/.github/CODEOWNERS                                           @cloudQuant
+/.github/PULL_REQUEST_TEMPLATE.md                             @cloudQuant
+/.github/workflows/**                                        @cloudQuant
+/.github/workflows/pr-governance.yml                         @cloudQuant
+/.github/governance/**                                       @cloudQuant
+/.github/governance/risk-paths.json                          @cloudQuant
+/.github/governance/reviewer-authorization.json              @cloudQuant
+/.github/dependabot.yml                                      @cloudQuant
+/scripts/ci/governance_contract.py                           @cloudQuant
+/scripts/ci/verify_github_governance.py                      @cloudQuant
+/scripts/ci/check_pr_governance.py                            @cloudQuant
+/scripts/ci/classify_pr_risk.py                               @cloudQuant
+/scripts/ci/check_pr_template.py                              @cloudQuant
+/scripts/ci/security_scan.sh                                 @cloudQuant
+/.pre-commit-config.yaml                                     @cloudQuant
+/.dockerignore                                               @cloudQuant
+/src/backend/app/api/auth*                                   @cloudQuant
+/src/backend/app/api/_dependencies.py                        @cloudQuant
+/src/backend/app/api/deps.py                                 @cloudQuant
+/src/backend/app/api/**/deps.py                              @cloudQuant
+/src/backend/app/api/live_trading/credentials.py             @cloudQuant
+/src/backend/app/config.py                                   @cloudQuant
+/src/backend/app/services/ai_router/provider_config_store.py @cloudQuant
+/src/backend/app/services/auth*                              @cloudQuant
+/src/backend/app/schemas/auth*                               @cloudQuant
+/src/backend/app/utils/security*                             @cloudQuant
+/src/backend/app/**/session*                                 @cloudQuant
+/src/backend/app/middleware/**                               @cloudQuant
+/src/backend/app/db/**                                       @cloudQuant
+/src/backend/app/models/**                                   @cloudQuant
+/src/frontend/src/router/**                                  @cloudQuant
+/src/frontend/src/stores/**                                  @cloudQuant
+/src/frontend/src/api/index.ts                               @cloudQuant
+/src/frontend/src/api/auth.ts                                @cloudQuant
+/src/frontend/src/api/*Topics.ts                             @cloudQuant
+/src/frontend/src/utils/session.ts                           @cloudQuant
+/src/frontend/src/utils/tokenRef.ts                          @cloudQuant
+/src/frontend/src/composables/use*Runtime.ts                @cloudQuant

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,60 @@
+name: Bug Report
+description: Report a reproducible problem in AI for Investor
+title: '[Bug] '
+labels: ['bug']
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Bug Description
+      description: A clear and concise description of what the bug is.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Minimal Reproduction Steps
+      description: |
+        Smallest steps to reproduce, starting from a fresh state.
+        Example:
+        1. Go to '...'
+        2. Click on '...'
+        3. See error
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual Behavior
+      description: What actually happened, including error messages.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Backtrader Web Version / Commit
+      placeholder: e.g. v1.x or commit SHA
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, browser, Python, Node, database (e.g. SQLite / PostgreSQL 16 / MySQL).
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant Logs
+      description: |
+        Paste relevant logs here. Redact credentials, tokens and API keys first.
+      render: shell
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,8 @@
-blank_issues_enabled: true
+blank_issues_enabled: false
 contact_links:
   - name: Documentation
     url: https://github.com/cloudQuant/backtrader_web/tree/master/docs
     about: Check our documentation before opening an issue
   - name: Discussions
     url: https://github.com/cloudQuant/backtrader_web/discussions
-    about: Ask questions and share ideas in Discussions
+    about: Ask general questions and share ideas in Discussions

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,51 @@
+name: Feature Request
+description: Suggest a new feature or improvement for AI for Investor
+title: '[Feature] '
+labels: ['enhancement']
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before requesting a feature, please search existing issues and Discussions
+        for duplicates.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem Statement
+      description: What problem does this feature solve? Who benefits from it?
+    validations:
+      required: true
+  - type: textarea
+    id: users
+    attributes:
+      label: Target Users / Scenarios
+      description: Who would use this and in which workflow?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed Solution
+      description: A clear description of what you want to happen.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+      description: Alternative solutions or features you've considered, including existing workarounds.
+    validations:
+      required: true
+  - type: checkboxes
+    id: contribution
+    attributes:
+      label: Willingness to Contribute
+      options:
+        - label: I am willing to submit a PR for this feature (targeting the `dev` branch)
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional Context
+      description: Related features, similar platforms, links.
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -3,6 +3,11 @@ Iteration 175 §4.7 — the "i18n 变更清单" section is mandatory and is veri
 by `scripts/ci/check_pr_template.py`. Please leave it in place even if your
 PR does not touch any string literals (state "无变更" / "no change" in the
 relevant subfields).
+
+Iteration 195 — the static "Governance declaration" contract is verified by
+`scripts/ci/check_pr_template.py`. Regular changes must target `dev`;
+`master` only accepts `release/vX.Y.Z` promotions and `hotfix/master-*`
+emergency fixes (see CONTRIBUTING.md, "Branch Model").
 -->
 
 ## What & Why
@@ -13,6 +18,27 @@ relevant subfields).
 
 <!-- High-level approach. Link to design doc / issue if relevant. -->
 
+## Governance declaration
+
+<!-- Required by iteration 195 PR Governance. Fill every field; placeholders fail CI. -->
+
+- **目标分支**: <!-- dev，或 master + release/hotfix 理由 -->
+- **风险等级**: <!-- R0 docs / R1 常规 / R2 核心路径（auth、DB、router/stores、bt_api_py）/ R3 workflow、docker、依赖。以变更路径自动分类为准，label 不能下调 -->
+- **测试证据**: <!-- 本地/CI 测试命令与结果，或链接 -->
+
+<!--
+GitHub uses one PR template and cannot conditionally hide these sections. Normal PRs should
+delete or ignore both master-only sections; only a master hotfix or release PR must keep and
+complete its corresponding section.
+-->
+## Hotfix 前移计划 (master hotfix PRs only)
+
+- **前移计划**: <!-- incident reference；等价修复在 dev 的 issue/PR 链接，或“不受影响”的理由 -->
+
+## Release 清单 (master release promotion PRs only)
+
+- **Release 清单**: <!-- 版本号、changelog 链接、完整验证证据、回滚点说明 -->
+
 ## Test Plan
 
 <!-- How did you verify the change? Unit tests, e2e, manual repro, etc. -->

.github/dependabot.yml

@@ -18,6 +18,12 @@ updates:
       - "python"
     commit-message:
       prefix: "chore(deps)"
+    # mypy 2.x is deferred (194 Task J): the repo-wide ratchet baseline is
+    # pinned to mypy 1.20.2; upgrading requires lock + baseline regeneration
+    # plus a re-audit of the 759 historical errors (194 Task I).
+    ignore:
+      - dependency-name: "mypy"
+        versions: [">=2"]
 
   # Frontend (npm)
   - package-ecosystem: "npm"
@@ -31,8 +37,19 @@ updates:
       - "frontend"
     commit-message:
       prefix: "chore(deps)"
+    # pinia 3+/4 and @vitejs/plugin-vue 6 are major migrations deferred to
+    # 194 Task J: they need full vitest/build validation and possibly code
+    # adaptation before landing, not just the ratchet baseline refresh.
+    ignore:
+      - dependency-name: "pinia"
+        versions: [">=3"]
+      - dependency-name: "@vitejs/plugin-vue"
+        versions: [">=6"]
 
   # Docker base images
+  # Runtime majors (python >=3.13, node >=21) are deferred to 194 Task J:
+  # the publish pipeline has no pre-release validation, so each upgrade
+  # needs a dedicated compatibility check first. Patch tags still flow.
   - package-ecosystem: "docker"
     directory: "/src/backend"
     schedule:
@@ -43,6 +60,9 @@ updates:
       - "docker"
     commit-message:
       prefix: "chore(deps)"
+    ignore:
+      - dependency-name: "python"
+        versions: [">=3.13"]
 
   - package-ecosystem: "docker"
     directory: "/src/frontend"
@@ -54,6 +74,9 @@ updates:
       - "docker"
     commit-message:
       prefix: "chore(deps)"
+    ignore:
+      - dependency-name: "node"
+        versions: [">=21"]
 
   # GitHub Actions
   - package-ecosystem: "github-actions"