Initial commit: SKEEN Derma Experts - Sistema Integral de Gestión Clínica

- Frontend React (SKEEN Brand) con Vite, TypeScript, Tailwind
- Frontend Homenest (versión alternativa)
- Módulos Odoo 17 custom (citas, pacientes, monedero, pagos, ventas, inventario, whatsapp)
- WACRM fork (Next.js 16 + Supabase)
- Hermes + Bridge + Skills (Qwen3.6 via Nan Builders)
- Scripts de migración y operación
- Documentación extensiva en docs/

wacrm/.github/CODEOWNERS

@@ -0,0 +1,8 @@
+# Everyone who opens a PR against this repo gets Arnas as a required
+# reviewer. Paired with a branch-protection rule on `main` that
+# requires Code Owner approval, this ensures every change is reviewed
+# before merge.
+#
+# Syntax: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-security/customizing-your-repository/about-code-owners
+
+* @ArnasDon

wacrm/.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,28 @@
+# Code of Conduct
+
+This project adopts the **[Contributor Covenant, version 2.1][covenant]**.
+
+By participating in this project — filing an issue, opening a PR, commenting
+on one, or interacting in any other community space — you agree to uphold
+that standard.
+
+## Reporting
+
+If you witness or experience behaviour that violates the Code, please
+report it privately to the project maintainer:
+
+- Email: **a.donauskas@hostinger.com** with `[CRM template conduct]` in
+  the subject.
+
+Reports are handled confidentially. Expect an acknowledgement within
+72 hours and a decision on next steps within a week.
+
+## Enforcement
+
+The maintainer is responsible for enforcement and will apply the community
+impact guidelines described in the [Contributor Covenant][covenant-enforce]
+— ranging from a private correction to a permanent ban, proportional to the
+behaviour.
+
+[covenant]: https://www.contributor-covenant.org/version/2/1/code_of_conduct/
+[covenant-enforce]: https://www.contributor-covenant.org/version/2/1/code_of_conduct/#enforcement-guidelines

wacrm/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,76 @@
+name: Bug report
+description: Something in the template isn't working the way the docs say it should.
+title: "[bug] "
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting! The more specific you can be, the faster we
+        can land a fix.
+
+        **Not a bug in the code?** If this is a security issue, close this
+        form and follow [SECURITY.md](https://github.com/ArnasDon/wacrm/blob/main/.github/SECURITY.md)
+        instead.
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: What happened?
+      description: One or two sentences describing the symptom.
+      placeholder: Clicking a conversation leaves the thread stuck on "No messages yet".
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: The minimum steps we need to trigger the bug on our side.
+      placeholder: |
+        1. Sign in, go to /inbox.
+        2. Click any conversation that has past messages.
+        3. Thread pane shows "No messages yet" until hard refresh.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect?
+      placeholder: Messages load the first time, every time.
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Commit / version
+      description: |
+        The commit SHA or release you're on. `git rev-parse --short HEAD`
+        in the fork works.
+      placeholder: "e.g. d6a4677 or v0.2.0"
+    validations:
+      required: false
+
+  - type: dropdown
+    id: runtime
+    attributes:
+      label: Where is it running?
+      options:
+        - Local dev (npm run dev)
+        - Hostinger Managed Node.js
+        - Hostinger VPS
+        - Vercel
+        - Other Node host
+    validations:
+      required: false
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / screenshots
+      description: Server logs, browser console errors, network tab — anything that looks suspicious. Scrub tokens before pasting.
+      render: text
+    validations:
+      required: false

wacrm/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability (private)
+    url: https://github.com/ArnasDon/wacrm/security/advisories/new
+    about: Do not file security issues in public. Follow the private disclosure flow.
+  - name: Setup / "how do I..." questions
+    url: https://github.com/ArnasDon/wacrm/blob/main/docs/README.md
+    about: Check the docs first — setup, deploy, troubleshooting are all covered.
+  - name: Using this as a template (forking)
+    url: https://github.com/ArnasDon/wacrm/blob/main/CONTRIBUTING.md
+    about: This is a template. Most changes belong in your fork, not an upstream issue — here's how that works.

wacrm/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,68 @@
+name: Feature request
+description: Propose a new feature or a meaningful enhancement.
+title: "[feat] "
+labels: ["enhancement", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the idea — but read this first.
+
+        This is a **template**, not a collaborative product. The
+        upstream scope is intentionally narrow, so most feature
+        requests end up as *"build this in your fork"* rather than
+        landing here. That's the point of a template.
+
+        When an upstream feature request *is* useful:
+
+        - It fixes a correctness problem in the template.
+        - It makes the template cleaner for the next forker (reducing
+          friction, removing footguns).
+        - It's in scope for "a generic WhatsApp CRM template" rather
+          than a bet on your specific workflow.
+
+        If the feature is really for your own deployment, fork and
+        build it there — see
+        [CONTRIBUTING.md](https://github.com/ArnasDon/wacrm/blob/main/CONTRIBUTING.md).
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: What's the problem?
+      description: What are you trying to do today that the template makes harder than it should?
+      placeholder: |
+        When a broadcast ends I have no way to see which recipients
+        didn't reply so I can follow up manually.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What would you like to see?
+      description: Describe the feature from the user's perspective, not the implementation.
+      placeholder: |
+        On the broadcast detail page, a "No reply" filter that lists
+        recipients who received but didn't reply within 24 hours.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives you considered
+      description: Things that kinda work today, workarounds, related features in other tools.
+    validations:
+      required: false
+
+  - type: dropdown
+    id: scope
+    attributes:
+      label: Scope
+      description: Your guess — we'll re-scope if needed.
+      options:
+        - Small (a couple of hours)
+        - Medium (a couple of days)
+        - Large (a couple of weeks, probably breaks into multiple PRs)
+    validations:
+      required: false

wacrm/.github/SECURITY.md

@@ -0,0 +1,62 @@
+# Security Policy
+
+Thanks for taking the time to look into the security of this template.
+
+## Reporting a vulnerability
+
+**Do not open a public GitHub issue for security bugs.** Public issues are
+indexed by search engines and seen by every fork long before the upstream fix
+lands.
+
+Instead, please report privately via one of:
+
+- [GitHub Security Advisories](https://github.com/ArnasDon/wacrm/security/advisories/new)
+  (preferred — keeps the disclosure, fix, and CVE all in one place).
+- Email: `a.donauskas@hostinger.com` with `[CRM template security]` in the subject.
+
+Include, if you can:
+
+- A description of the issue and the impact.
+- Reproduction steps or a proof-of-concept.
+- The commit or release you're testing against.
+- Whether you'd like credit in the eventual disclosure (we default to
+  crediting by the name or handle you give us, unless you prefer anonymous).
+
+## What to expect
+
+- **Acknowledgement** within 72 hours.
+- **Initial assessment** (severity, affected versions, whether a workaround
+  exists) within one week.
+- **Fix + coordinated disclosure** on a timeline proportional to severity.
+  Critical issues ship a patch as soon as one's ready; medium issues bundle
+  with the next release.
+
+## Scope
+
+In scope:
+- Anything in this repository (`ArnasDon/wacrm`), including webhook and auth
+  flows, token encryption, RLS policies, and the built-in cron endpoints.
+- Default configurations shipped in `docs/` — e.g. if the setup guide leaves
+  an unsafe default.
+
+Out of scope:
+- Vulnerabilities in Supabase, Next.js, Node.js, or other upstream
+  dependencies — please report those to their maintainers. We'll happily
+  bump versions on request.
+- Issues that require a pre-compromised deployment (e.g. a leaked
+  service-role key) unless they widen the blast radius beyond the initial
+  compromise.
+- Social engineering, physical attacks, or third-party services your fork
+  adds after deploy.
+
+## Safe harbor
+
+Research conducted under this policy is authorized. We won't pursue legal
+action against anyone who:
+
+- Makes a good-faith effort to avoid data destruction, privacy violations,
+  or service disruption.
+- Gives us reasonable time to respond before any public disclosure.
+- Doesn't exploit the issue beyond what's necessary to demonstrate it.
+
+Thanks for helping keep this template (and its forks) safe.

wacrm/.github/dependabot.yml

@@ -0,0 +1,53 @@
+version: 2
+updates:
+  # Runtime + dev dependencies. Weekly on Mondays — keeps the noise
+  # predictable and aligns with a normal review cycle.
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    reviewers:
+      - ArnasDon
+    labels:
+      - dependencies
+    groups:
+      # Batch related upgrades into one PR so we're not closing six
+      # independent Supabase-bumps per week.
+      supabase:
+        patterns:
+          - "@supabase/*"
+      types:
+        patterns:
+          - "@types/*"
+        update-types:
+          - minor
+          - patch
+      dev-dependencies:
+        dependency-type: development
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # Next + React + Tailwind are pinned exactly on purpose. Let
+      # them flow through manual major bumps when we're ready.
+      - dependency-name: next
+      - dependency-name: react
+      - dependency-name: react-dom
+      - dependency-name: tailwindcss
+      - dependency-name: eslint-config-next
+
+  # GitHub Actions in .github/workflows/. Catches setup-node /
+  # checkout version bumps that keep the CI matrix healthy.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    reviewers:
+      - ArnasDon
+    labels:
+      - dependencies
+      - github-actions

wacrm/.github/pull_request_template.md

@@ -0,0 +1,42 @@
+<!--
+Heads up: this is a template, not a collaborative product. Most
+changes belong in your fork. See CONTRIBUTING.md for which kinds of
+upstream PRs tend to land (security, correctness, docs) vs. which
+belong in a fork (new features, stack swaps, opinionated refactors).
+If you haven't opened an issue yet for a non-trivial change, consider
+doing that first to check alignment.
+
+Keep this short and specific. The commit message is where the "why"
+lives; this is where the reviewer gets the "what" and "how to try it".
+-->
+
+## Summary
+
+<!-- One or two sentences. What does this PR do? -->
+
+## What changed
+
+<!-- Bullet list of the actual changes. Link file paths when useful. -->
+
+## Test plan
+
+<!--
+How did you verify this works? How should the reviewer verify it?
+Tick the boxes as you go.
+-->
+
+- [ ] `npm run typecheck` clean.
+- [ ] `npm run lint` — no new errors beyond the pre-existing backlog.
+- [ ] `npm run build` succeeds.
+- [ ] Feature / fix manually exercised in the browser (or the reason it can't be).
+
+## Related
+
+<!-- Link the issue this closes, or "Part of #N" for multi-PR work. -->
+
+<!--
+Heads up:
+- Security issues: do not disclose here; see .github/SECURITY.md.
+- New deps: please justify briefly in the commit message or PR body.
+- Runtime behaviour changes affecting forkers: update docs/*.
+-->

wacrm/.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+# Cancel older CI runs for the same branch when a new commit arrives —
+# saves minutes when someone pushes a stack of fixes to one PR.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: Lint, typecheck, test, build
+    runs-on: ubuntu-latest
+    # Dummy env vars so `next build` doesn't fail when it reads the
+    # public Supabase config at build time. These never leave CI and
+    # never hit a real service — they just satisfy the `!` non-null
+    # assertions in the client factories. ENCRYPTION_KEY and
+    # META_APP_SECRET are read at module-load by lib/whatsapp/*; the
+    # test suite asserts behaviour around these values, so any non-
+    # empty placeholder works as long as it stays consistent with
+    # vitest.config.ts.
+    env:
+      NEXT_PUBLIC_SUPABASE_URL: https://ci.example.supabase.co
+      NEXT_PUBLIC_SUPABASE_ANON_KEY: ci-dummy-anon-key
+      ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000'
+      META_APP_SECRET: 'ci-dummy-meta-secret'
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Test
+        run: npm test
+
+      - name: Build
+        run: npm run build