build: ship RAG refinement product — all CI green (#280)

Squash-merge of PR #280 (build/rag-refinement-product). All 5 CI jobs pass: lint, typecheck, test, security, frontend-security.

Author: piyushmakhija28

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,54 @@
+name: Bug Report
+description: Report a bug in the RAG Refinement System
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for reporting a bug. Please fill in the details below.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: A clear description of the bug.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Minimal steps to reproduce the issue.
+      placeholder: |
+        1. Start the server with `docker compose up`
+        2. Send a request to POST /v1/route with ...
+        3. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behaviour
+      description: What did you expect to happen?
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Python version, OS, Docker version if applicable.
+      placeholder: |
+        Python: 3.11.9
+        OS: Ubuntu 22.04
+        Docker: 26.1.0
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs or error output
+      render: shell

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,36 @@
+name: Feature Request
+description: Suggest a new feature or improvement
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for suggesting an improvement!
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: Describe the problem or limitation you are running into.
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: Describe the feature or change you would like to see.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Other approaches you thought about.
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Any other context, screenshots, or references.

.github/pull_request_template.md

@@ -0,0 +1,23 @@
+## Summary
+
+<!-- What does this PR do? Why? One paragraph. -->
+
+## Changes
+
+<!-- Bullet list of what changed and in which files. -->
+
+-
+
+## Testing
+
+- [ ] All existing tests pass (`pytest -q`)
+- [ ] New tests added for new behaviour
+- [ ] Coverage remains at 100% (`pytest --cov-fail-under=80`)
+- [ ] Lint passes (`ruff check backend ingestion tests`)
+- [ ] Type-check passes (`mypy backend ingestion router db`)
+- [ ] Security scan passes (`bandit -c pyproject.toml -r backend ingestion router db`)
+- [ ] Frontend tests pass (`cd frontend && npm run test`)
+
+## Related issues
+
+Closes #

.github/workflows/ci.yml

@@ -62,7 +62,7 @@ jobs:
       - name: Install security tooling
         run: pip install ".[dev]"
       - name: Bandit SAST (blocking)
-        run: bandit -r backend ingestion router db
+        run: bandit -c pyproject.toml -r backend ingestion router db
       - name: pip-audit SCA (blocking)
         run: pip-audit
       - name: detect-secrets scan (blocking)
@@ -78,7 +78,7 @@ jobs:
           import sys
 
           def _key(path, secret):
-              return (path, secret["line_number"], secret["type"])
+              return (path, secret["line_number"], secret["type"], secret["hashed_secret"])
 
           with open(".secrets.baseline", encoding="utf-8") as f:
               baseline = json.load(f)