Initial commit: Complete NodeJS-native setup

- Migrated from Python pre-commit to NodeJS-native solution
- Reorganized documentation structure
- Set up Husky + lint-staged for efficient pre-commit hooks
- Fixed Dockerfile healthcheck issue
- Added comprehensive documentation index

docs/development/APPLICATION_SECURITY.md

@@ -0,0 +1,162 @@
+# Security Guide
+
+## 🔐 Security Best Practices for Medication Reminder App
+
+### **Password Security**
+
+#### **Password Requirements**
+
+- Minimum 8 characters
+- Must contain uppercase and lowercase letters
+- Must contain at least one number
+- Must contain at least one special character
+- Cannot be common passwords (password123, admin, etc.)
+
+#### **Password Hashing**
+
+- Uses bcrypt with salt rounds for secure password storage
+- Passwords are never stored in plain text
+- Password verification happens through secure hash comparison
+
+### **Authentication Security**
+
+#### **Session Management**
+
+- JWT-like token system for user sessions
+- Tokens have expiration times
+- Secure token storage and transmission
+- Automatic session cleanup on logout
+
+#### **Email Verification**
+
+- All new accounts require email verification
+- Verification tokens are time-limited
+- Prevents unauthorized account creation
+- Uses cryptographically secure random tokens
+
+#### **OAuth Security**
+
+- Supports Google and GitHub OAuth
+- Secure OAuth flow implementation
+- No password storage for OAuth users
+- Account linking prevention for security
+
+### **Environment Security**
+
+#### **Environment Variables**
+
+- Never commit `.env` files to version control
+- Use separate environment files for different deployments
+- Rotate credentials regularly
+- Use strong, unique passwords for each environment
+
+#### **Docker Security**
+
+- Non-root user for application execution
+- Multi-stage builds to minimize attack surface
+- Health checks for service monitoring
+- Isolated network for services
+
+### **Database Security**
+
+#### **CouchDB Security**
+
+- Admin authentication required
+- Database-level access control
+- SSL/TLS encryption for production
+- Regular backup and security updates
+
+#### **Data Protection**
+
+- User data isolation by user ID
+- Input validation and sanitization
+- Protection against injection attacks
+- Secure data deletion capabilities
+
+### **Production Security Checklist**
+
+#### **Before Deployment**
+
+- [ ] Change default admin password
+- [ ] Configure strong CouchDB credentials
+- [ ] Set up Mailgun with proper API keys
+- [ ] Enable SSL/TLS certificates
+- [ ] Configure firewall rules
+- [ ] Set up monitoring and logging
+
+#### **Regular Security Tasks**
+
+- [ ] Rotate credentials monthly
+- [ ] Update dependencies regularly
+- [ ] Monitor logs for suspicious activity
+- [ ] Backup databases securely
+- [ ] Review user access permissions
+- [ ] Test disaster recovery procedures
+
+### **Incident Response**
+
+#### **Security Breach Protocol**
+
+1. **Immediate Response**
+   - Disable affected accounts
+   - Change all credentials
+   - Review access logs
+   - Document the incident
+
+2. **Investigation**
+   - Identify breach source
+   - Assess data exposure
+   - Notify affected users
+   - Implement fixes
+
+3. **Recovery**
+   - Restore from secure backups
+   - Update security measures
+   - Monitor for further issues
+   - Conduct post-incident review
+
+### **Compliance Considerations**
+
+#### **Data Privacy**
+
+- User data minimization
+- Right to data deletion
+- Transparent privacy policy
+- Secure data export capabilities
+
+#### **Healthcare Compliance**
+
+- HIPAA considerations for health data
+- Secure medication information handling
+- Audit trail capabilities
+- Data retention policies
+
+### **Security Monitoring**
+
+#### **Logging**
+
+- Authentication attempts
+- Failed login monitoring
+- Admin actions tracking
+- Database access logging
+
+#### **Alerting**
+
+- Multiple failed login attempts
+- Admin privilege escalation
+- Unusual data access patterns
+- System health issues
+
+### **Emergency Contacts**
+
+#### **Security Issues**
+
+- Development Team: security@your-domain.com
+- System Administrator: admin@your-domain.com
+- Emergency Response: +1-XXX-XXX-XXXX
+
+#### **Third-party Services**
+
+- Mailgun Support: support@mailgun.com
+- CouchDB Security: security@apache.org
+- Docker Security: security@docker.com