feat: add changelog automation, gitpod config, dev portal, and security headers

[vjuliaife]

Summary

Adds developer-experience tooling for AgenticPay: automated changelog generation from Conventional Commits, a Gitpod configuration to complement the existing DevContainer setup, a developer portal with an API playground and interactive documentation, and a dedicated security headers middleware enforcing HSTS and a Permissions-Policy.

Changes

• Added .releaserc.json and .github/workflows/release.yml configuring semantic-release to generate CHANGELOG.md and GitHub releases from Conventional Commits on every push to main; added the semantic-release, @semantic-release/changelog, and @semantic-release/git devDependencies and a release npm script.
• Added .gitpod.yml, reusing the existing .devcontainer/Dockerfile and root docker-compose.yml, so a Gitpod workspace installs dependencies, generates the Prisma client, starts Postgres/Redis, and runs npm run dev automatically, alongside the existing DevContainer config.
• Mounted the previously unused docsRouter at /docs in backend/src/index.ts, enabling the Swagger UI API playground and raw OpenAPI JSON endpoint; added frontend/app/developers/page.tsx, a developer portal page linking to the API playground, the OpenAPI spec, and the official TypeScript/Python/Go SDKs and their guides.
• Added securityHeadersMiddleware in backend/src/middleware/security.ts, wired in as the first middleware in backend/src/index.ts, which sets the Strict-Transport-Security (HSTS) and Permissions-Policy headers on every response; both are configurable via new HSTS_MAX_AGE_SECONDS and PERMISSIONS_POLICY environment variables added to backend/src/config.ts and documented in backend/.env.example. This is kept independent of the existing (unused) CSP-bundling security stack to avoid overlapping with separate CSP work.

Issues

Resolves #761
Resolves #760
Resolves #758
Resolves #757

Verification

Manual code review completed: git status, git diff --stat, and the full git diff were inspected, and every changed/added file was confirmed relevant to one of the four issues above. cargo build and cargo test were not run — no build or test commands were executed. No snapshots or generated files were committed.

[vercel]

@vjuliaife is attempting to deploy a commit to the smartdevs17's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@vjuliaife Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits