Docs: new README (Arabic flows, screenshots, architecture) + AGENT.md for AI agents

- README rewritten for the real Next.js + Payload + Postgres stack
  (old one described the dead static prototype)
- Logo + 4 live screenshots (home, articles, post, subscription)
- Arabic flow explanations with mermaid diagrams: visitor journey,
  content pipeline, request path
- Architecture table, quick start, API reference, security summary,
  deploy commands
- AGENT.md: orientation for future AI agents (data model, trust rules,
  rate limits, routes, env, deploy, house rules)
- GLOSSARY.md and docs/adr committed (linked from README)

docs/adr/0004-coming-soon-subscribe-public-launch.md

@@ -0,0 +1,28 @@
+# ADR 0004 — Coming-soon subscribe on public launch (no simulated VIP)
+
+Date: 2026-10-03
+
+## Status
+
+Accepted
+
+## Context
+
+Until Stripe keys exist, the subscribe flow had two self-grant holes that are fatal on a public site:
+
+1. `POST /api/subscribe` (no keys) returned `{ url: '/payment-success?simulated=1' }`.
+2. `/payment-success` without a `session_id` set `activate = true` — i.e. any logged-in user visiting the URL became `role: 'vip'` for free.
+
+On the public internet this lets anyone self-grant VIP.
+
+## Decision
+
+- With no Stripe keys, `POST /api/subscribe` returns `{ comingSoon: true }` and no `url`; `SubscribeButton` already renders a disabled «قريباً» button whenever the response has no `url`.
+- `/payment-success` no longer activates anything without a session: the `else if (!sessionId) { activate = true }` branch is deleted and `simulated` is removed from the page props. After the activation block, free users (`role` not `vip`/`admin`) are redirected to `/subscription`. VIP/admin users pass through to the success copy.
+- The real Stripe path is unchanged: `session_id` present + `STRIPE_SECRET_KEY` set → session verified with Stripe → VIP activated.
+- When Stripe keys land, the same pages switch to real Checkout without further flow changes.
+
+## Consequences
+
+- No revenue until Stripe is configured; VIP can still be granted manually by an admin in `/admin`.
+- Anyone with a saved `?simulated=1` link gets redirected — the query param is simply ignored now.