chore(twenty-website-redone): carry over README assets, .well-known, and an env template

Prep for deleting the legacy twenty-website package. Once twenty-website-redone
takes over its public/ path, these files must already live here so nothing 404s
or loses its template:

- Copy the 37 root-README documentation assets (public/images/readme/) plus the
  README header logo (public/images/core/logo.svg). Files only — the root
  README's references are left untouched; they resolve automatically after the
  rename. check-conventions gains a labeled README-doc carve-out so its
  owned-glyph SVG audit no longer flags them.
- Copy the three served verification files into public/.well-known/ (security.txt,
  openai-apps-challenge, microsoft-identity-association.json) and register
  .well-known in RESERVED_PREFIXES so the public-dir inventory guard passes; a
  rewrite test locks that .well-known paths — including the extensionless
  challenge file — pass through the locale rewrites untouched.
- Add a tailored .env.example derived from the package's actual env reads, not a
  blind copy of the old file (drops the unused GITHUB_TOKEN, visual-runtime kill
  switches, and partner-intro cal link). A .gitignore negation tracks it.

Author: mabdullahabaid

packages/twenty-website-redone/.env.example

@@ -0,0 +1,27 @@
+# Public site URL — canonical origin used by metadataBase, sitemap, robots,
+# OG/Twitter card URLs, Stripe checkout success URL, and the billing portal
+# return URL. No trailing slash. Defaults to https://twenty.com when unset.
+NEXT_PUBLIC_WEBSITE_URL=
+
+# Partner application — the form POSTs to /api/partner-application, which
+# forwards the payload to this webhook with the secret as a bearer credential.
+PARTNER_APPLICATION_WEBHOOK_URL=
+PARTNER_APPLICATION_SECRET=
+
+# Partners marketplace — the Twenty workspace the partner directory reads from
+# (server-side only) via the /s/partners REST endpoint.
+TWENTY_PARTNERS_API_URL=
+TWENTY_PARTNERS_API_KEY=
+
+# Stripe — self-hosted enterprise checkout & subscription APIs.
+STRIPE_SECRET_KEY=
+STRIPE_ENTERPRISE_MONTHLY_PRICE_ID=
+STRIPE_ENTERPRISE_YEARLY_PRICE_ID=
+
+# RS256 key pair used to sign and verify enterprise license JWTs
+# (use literal \n for newlines in the PEM values).
+ENTERPRISE_JWT_PRIVATE_KEY=
+ENTERPRISE_JWT_PUBLIC_KEY=
+
+# Optional: enterprise validity token lifetime in days (default 30).
+# ENTERPRISE_VALIDITY_TOKEN_DURATION_DAYS=

packages/twenty-website-redone/.gitignore

@@ -7,6 +7,7 @@ yarn-debug.log*
 yarn-error.log*
 .env
 .env*
+!.env.example
 *.tsbuildinfo
 next-env.d.ts
 

packages/twenty-website-redone/public/.well-known/microsoft-identity-association.json

@@ -0,0 +1,13 @@
+{
+  "associatedApplications": [
+    {
+      "applicationId": "7ad664fb-ab90-4fb1-bf20-bba9cba9fc69"
+    },
+    {
+      "applicationId": "d4ca5765-1a9c-4b71-b97d-4d806814f8b7"
+    },
+    {
+      "applicationId": "cf541b92-f5ae-4e2b-a54e-4796ec8394e1"
+    }
+  ]
+}

packages/twenty-website-redone/public/.well-known/openai-apps-challenge

@@ -0,0 +1 @@
+6-1tez_gHTN3rqJBhwcxsc6k1BM8vwglvmV7ERKHrSk

packages/twenty-website-redone/public/.well-known/security.txt

@@ -0,0 +1,5 @@
+Contact: https://github.com/twentyhq/twenty/issues/new
+Contact: security@twenty.com
+Preferred-Languages: en
+Canonical: https://twenty.com/.well-known/security.txt
+Policy: https://github.com/twentyhq/twenty/security/policy