docs(showcase): add public qlockify showcase + screenshots

docs/architecture.md

@@ -0,0 +1,43 @@
+# Architecture
+
+Qlockify is deployed as a containerized web application behind Nginx.
+
+## Runtime Flow
+
+![Qlockify runtime request flow](../assets/diagrams/qlockify-runtime-request-flow.png)
+
+High-level request flow:
+
+- Browser requests are served through Nginx.
+- Static frontend assets are served by the frontend container.
+- API and admin requests are proxied to the Django backend.
+- Django stores relational data in PostgreSQL.
+- Redis is used for cache, async job brokering, and background coordination.
+- Celery workers process async jobs.
+- Celery Beat schedules recurring jobs such as demo cleanup.
+
+## Multi-Repo Setup
+
+![Qlockify runtime request flow](../assets/diagrams/qlockify-multi-repo-layout.png)
+
+The actual source uses separate private repositories for:
+
+- backend application code
+- frontend application code
+- deployment/orchestration configuration
+
+This keeps application changes, frontend changes, and production operations changes isolated from each other. The public showcase repository does not include those private repositories or their deployment files.
+
+## Public Safety Boundary
+
+This repository intentionally excludes:
+
+- source code
+- database migrations and schemas
+- Docker Compose and Nginx configuration
+- CI/CD workflows
+- backup scripts
+- environment variables
+- private repository URLs with credentials
+- real production logs or user data
+

docs/demo-guide.md

@@ -0,0 +1,32 @@
+# Demo Guide
+
+Qlockify includes a public demo flow for exploring the product without accessing real customer data.
+
+## How to Try It
+
+1. Open [https://qlockify.ir](https://qlockify.ir).
+2. Use the demo call-to-action on the landing page.
+3. The app creates a temporary isolated workspace and logs you in as the demo owner.
+4. Explore timesheets, clients, projects, tags, access management, and reports.
+
+## Demo Data
+
+The demo workspace includes realistic sample data such as:
+
+- workspace members
+- clients and projects
+- tags
+- time entries
+- billable work
+- hourly rates
+- project access rules
+- reportable activity
+
+## Isolation
+
+Each demo visitor gets a separate demo environment. Actions in one demo do not affect other demo users or production users.
+
+## Expiration
+
+Demo environments are temporary and are cleaned automatically. Do not enter sensitive or real customer data in the demo.
+

docs/features.md

@@ -0,0 +1,40 @@
+# Features
+
+## Time Tracking
+
+- Live timer for active work sessions
+- Manual time entry for missed or corrected work
+- Billable and non-billable tracking
+- Project, client, and tag attribution
+- Mobile-friendly timesheet interactions
+
+## Workspace Management
+
+- Workspace roles for owners, admins, members, and guests
+- Member management and bulk member import
+- Project access control for normal workspace users
+- Workspace and project-level hourly rates
+
+## Reporting
+
+- Table and chart report views
+- All-users summary reports for admins and owners
+- Per-user daily summaries
+- Client, project, and tag breakdowns
+- Excel and PDF exports with localized Persian/English output
+
+## Authentication
+
+- Mobile-first auth flow
+- Password login
+- OTP login and password recovery
+- Google OAuth account linking with mobile confirmation
+- Isolated demo entry for public product trials
+
+## Operations
+
+- Dockerized production deployment
+- Background workers and scheduled cleanup jobs
+- Encrypted backup flow to S3-compatible object storage
+- Audit logs and notifications
+

docs/security-and-privacy.md

@@ -0,0 +1,26 @@
+# Security and Privacy
+
+## Source Code Privacy
+
+Qlockify source code is private. This showcase repository is documentation-only and does not contain backend, frontend, deployment, or infrastructure source.
+
+## Demo Safety
+
+The public demo uses isolated temporary data. Demo users should not enter real customer data, private notes, credentials, or sensitive business information.
+
+## Public Repository Rules
+
+Do not commit:
+
+- `.env` files
+- credentials or API keys
+- production logs
+- database dumps
+- customer screenshots
+- private deployment scripts
+- internal-only URLs or access tokens
+
+## Contact
+
+For product or technical questions, use the contact channels listed on the public Qlockify website.
+