Merge origin/main (license, compose, #65 leak guard) into cans work

README.md

@@ -77,10 +77,41 @@ curl -X POST http://localhost:8080/api/pastes \
   -d '{"content": "print(hello)", "language": "python", "expires_in": "168h"}'
 ```
 
-Full API docs: [docs/API.md](docs/API.md).
+Full API docs: [docs/API.md](docs/API.md). Design docs: [docs/design/](docs/design/) (currently: [client-side E2E encryption](docs/design/e2e-encryption.md), issue #39).
+
+## Performance Notes
+
+The history and Saved pages use client-side filtering: when you type in the
+search box, the UI fetches the most recent 100 pastes (`limit=100`, the API
+maximum) once per query and filters/sorts them in the browser. Pastes beyond
+the newest 100 are not searched; a match count against the full total is still
+shown. This keeps search instant without a server-side query. If large
+instances need full search later, it will be a server-side endpoint (see
+issue #32).
 
 ## CI
 
 Gitea Actions workflow at `.gitea/workflows/ci.yml`:
 - On push to main: `go vet` + `go test`
 - On tags: build and push Docker image to `git.archfox.org/poslop/palette`
+
+## Docker Compose
+
+See [docker-compose.yml](docker-compose.yml) for a ready-to-use example with
+every environment variable documented, including which are required (only the
+/data volume) and which are optional.
+
+## License
+
+Palette is licensed under the GNU Affero General Public License v3.0
+(AGPL-3.0-only). See [LICENSE](LICENSE).
+
+The software is provided AS IS, without warranty of any kind, express or
+implied, including merchantability and fitness for a particular purpose.
+In no event shall the authors be liable for any claim, damages, or other
+liability, including without limitation any security vulnerabilities,
+data loss, or legal issues arising from use of the software. You use it
+at your own risk.
+
+If you run a modified version of Palette as a network service, the AGPL
+requires you to offer your modified source code to its users.