docs: fix stale-live docs and drop obsolete Obsidian spec

Refreshes the docs that were actively misleading about the current
FastAPI + React + service-registry app, and deletes one obsolete design.

- CONTRIBUTING.md: full rewrite — Streamlit-era guidance replaced with
  the current backend (ruff/pytest, src/ layout) + frontend (npm
  lint/build/test) workflow, service-registry model, and shadcn/Tailwind
  stack. Mirrors AGENTS.md.
- README.md: removed the non-existent /addons/:addonId route (Services
  page is current); fixed the per-machine Jellyfin wording; replaced the
  py_compile dev snippet with ruff + pytest / npm lint+build+test.
- backend/README.md: updated the structure tree (removed deleted
  clients/resources.py; added routers backups/services/tasks/widgets,
  integrations/, models/, widgets/, workers/); dropped the "starts the
  collector" sentence (MonitoringPoller is decommissioned).
- frontend/README.md: corrected the uvicorn module path
  (main:app -> media_library_viewer_api.main:app).
- Deleted docs/superpowers/specs/2026-05-08-obsidian-documentation-design.md
  (Obsidian vault never built; stack refs MUI/D3/AG Grid all removed).

Historical docs (MIGRATION_PLAN, superpowers backup-monitoring, the
bannered design/runbook/context files) deferred to a later banner pass.

backend/README.md

@@ -13,29 +13,46 @@ backend/
 │       ├── __init__.py
 │       ├── main.py              # FastAPI app entrypoint
 │       ├── config.py            # pydantic-settings config
+│       ├── auth.py              # OIDC/JWT + API key auth
 │       ├── dependencies.py      # Dependency injection
+│       ├── observability.py     # Prometheus metrics + request IDs
+│       ├── logging_utils.py     # Structured JSON/text logging
 │       ├── path_utils.py        # Jellyfin→SSH path resolution
 │       ├── jobs.py              # Job templates
 │       ├── utils.py             # Formatting helpers
 │       ├── routers/
+│       │   ├── backups.py
 │       │   ├── dashboard.py
-│       │   ├── monitoring.py
-│       │   ├── media.py
-│       │   ├── users.py
-│       │   ├── settings.py
 │       │   ├── files.py
-│       │   └── jobs.py
+│       │   ├── jobs.py
+│       │   ├── media.py
+│       │   ├── monitoring.py
+│       │   ├── services.py
+│       │   ├── settings.py
+│       │   ├── tasks.py
+│       │   ├── users.py (+ users_impl.py)
+│       │   └── widgets.py
 │       ├── clients/
 │       │   ├── jellyfin.py
 │       │   ├── jellyseerr.py
 │       │   ├── local.py
-│       │   ├── resources.py
 │       │   └── ssh.py
+│       ├── integrations/        # Service-registry definitions
 │       ├── domain/
 │       │   └── media.py
-│       └── services/
-│           ├── media_index.py
-│           └── settings_store.py
+│       ├── models/              # Pydantic request/response models
+│       ├── services/
+│       │   ├── media_index.py (+ _impl.py)
+│       │   ├── settings_store.py
+│       │   ├── secrets.py       # Fernet encryption at rest
+│       │   ├── targets.py       # Node Exporter target discovery
+│       │   ├── task_runner.py
+│       │   ├── mail_queue.py (+ mailer.py/_impl.py)
+│       │   ├── backup_alert_engine.py (+ backup_poller.py)
+│       │   ├── known_hosts.py
+│       │   └── db_maintenance.py
+│       ├── widgets/             # Widget sources (dashboard data adapters)
+│       └── workers/             # Background workers (media index)
 └── tests/
 ```
 
@@ -127,7 +144,7 @@ docker compose up --build
    - **Local**: monitors the API host itself without SSH.
    - **SSH**: monitors another machine using a host, username, and a private key pasted directly into the machine settings, with an optional passphrase.
    - The machine editor groups Connection, Monitoring / Files, Jellyfin, Jellyseerr, and Notes under separate headings so each service area is easier to scan.
-   - Saving a monitoring machine now validates the banner/auth flow, records the first trusted host key into the backend-managed `known_hosts` file, and starts the collector so charts populate without a separate manual step.
+   - Saving a monitoring machine validates the banner/auth flow and records the first trusted host key into the backend-managed `known_hosts` file.
    - If the host cannot be reached or authenticated, the save flow surfaces the SSH error directly in the dialog.
    - Use **Validate SSH + trust host** in the machine editor before saving if you want to test the banner/auth flow explicitly.
    - The first successful SSH connection uses trust-on-first-use: the backend records that machine's host key into its managed `known_hosts` file automatically, then continues verifying it strictly on later connects.