Add copy-only, color swatches, DB speed pragmas, and living docs

- Copy only (right-click -> Copy): write to clipboard without
  auto-pasting or hiding the window
- Color swatches: hex/rgb/hsl entries show a preview chip
- SQLite WAL + synchronous=NORMAL so the UI can read while the
  clipboard poller writes
- Memoize list rows (React.memo) so selection/focus changes don't
  re-render every row's preview
- Add docs/GUIDE.md (living install + usage doc), docs/SHARING.md,
  docs/TESTING.md, docs/LAUNCH-AT-LOGIN.md, docs/PRODUCT.md,
  CHANGELOG.md, ROADMAP.md
- Add homelab Gitea Actions CI (.gitea/workflows/ci.yml) + gitleaks
  allowlist
- Bump version to 0.2.0

docs/TESTING.md

@@ -0,0 +1,56 @@
+# Testing
+
+maCopy has an automated suite. There is no separate “live” Storybook/UI docs site yet — product behavior is documented in README / ROADMAP, and verified by tests.
+
+## Commands
+
+| Command | What it runs |
+|---|---|
+| `npm test` | Frontend (Vitest + Testing Library, jsdom — CI default) |
+| `npm run test:ui` | Same tests in the Vitest UI (open in your browser) |
+| `npm run test:headed` | Unit tests in Chromium — still mostly a flash (DOM mount/unmount) |
+| `npm run test:visual` | **Watchable** headed Playwright walkthrough of the real UI (`visual.html`) |
+| `npm run test:watch` | Frontend in watch mode |
+| `npm run test:rust` | Rust unit tests (`cargo test`) |
+| `npm run test:all` | Frontend + Rust |
+| `npm run lint` | TypeScript `tsc --noEmit` |
+| `npm run check` | Lint + all tests (CI-style gate) |
+
+Current counts (approx.): **~60 frontend** + **~52 Rust** unit tests.
+
+## What is covered
+
+### Frontend (`src/**/*.test.tsx`, `transforms.test.ts`)
+
+- App: load entries, paste invoke, delete via keyboard
+- ClipboardList: selection, multi-select modifiers, image stubs/thumbs, Alt=plain paste
+- ContextMenu: Paste / Paste plain / transforms / Pin / Delete
+- SettingsPanel: toggles, history limit, hotkey recorder, **Launch at login → autostart enable**
+- SearchBar basics
+- Transforms: plain text strip, JSON pretty, collapse / oneline
+
+Tauri APIs are mocked in `src/test/setup.ts` (invoke, window, events, clipboard, autostart).
+
+### Backend (`src-tauri/src/**` `#[cfg(test)]`)
+
+- SQLite CRUD, FTS5, trim + pin preservation, settings
+- List previews: truncate text, omit image blobs, return thumbnails
+- Sensitive redaction (card / password / banking) while `get_entry` stays full
+- Hotkey parser (`cmd+\`` etc.)
+- Image thumbnail / PNG helpers
+- Clipboard content hashing fingerprints
+
+## What is *not* covered (yet)
+
+- End-to-end UI on a real Mac (no Playwright against the Tauri window)
+- Accessibility permission / AppleScript paste in CI
+- Notarized release smoke tests
+- Performance benchmarks in CI
+
+## Recommended workflow
+
+```bash
+npm run check          # before every PR / commit
+npm run tauri dev      # manual smoke: hotkey, paste, redaction, thumbs
+npm run tauri build    # release .app when testing Login Items / signing
+```