Truly one-click install + cleaner repo + collision-free port defaults

User asked for three things: easy install/start/stop with one click,
desktop shortcut that auto-runs the server, and a port no other software
will use. Two of those were partly done; the third was misleading because
the actual fallback constants were still 3005/3006.

What changed:

1. Truly one-click launch flow
   - scripts/local-sync.cjs: sidecar now auto-spawns the Next dev server
     on boot (was: wait for user to click "Start" in the launcher panel).
     Opt-out via ADFORGE_NO_AUTOSTART=1 for power users who want to edit
     code before the dev server boots.
   - OpenAdKit.bat: launcher now waits for the web app to actually respond
     (up to 90s while Next compiles first-run) and opens the browser
     DIRECTLY TO THE APP — not the control panel. The control panel is
     still reachable from the app footer for stop/restart/clean-rebuild.
   - scripts/start.sh: same — waits for the web app on PORT, falls back
     to launcher panel only if Next doesn't come up within 90s.
   - End-user flow is now: double-click .bat/.command → wait → app opens
     in browser. One double-click, one tab. Previously: double-click →
     control panel → click Start → wait → click Open → app opens (5 clicks).

2. High-range port defaults everywhere
   - Replaced every 3005/3006 fallback in scripts/local-sync.cjs,
     scripts/start.sh, scripts/start.bat, OpenAdKit.command with
     41573/41574. These constants only fire if the resolver didn't run
     AND no env var was passed — i.e. dead code in the happy path —
     but the user specifically asked for "a port no other software will
     ever use" and 3005 is the most-contested dev-server port in the
     world (Next, Vite, Express, CRA, Rails, Flask). 41573+ is in IANA's
     "registered but rarely used" range; nothing well-known binds there.
   - Updated misleading comments in resolve-ports.cjs and OpenAdKit.bat
     that still mentioned the old defaults.

3. File-tree cleanup (7 orphans removed)
   - Deleted internal audit/planning docs that lived at the repo root and
     confused new visitors looking for actual documentation:
       AUDIT-FINDINGS.md           (15 KB internal audit log)
       AUDIT-PROMPT.md             (5 KB internal — used to ask AIs to audit)
       EXTERNAL-AUDIT-PROMPT.md    (8 KB internal)
       PRODUCT-AUDIT-RATINGS.md    (20 KB internal rating doc)
       INSTALL-LAUNCH-IMPROVEMENTS.md  (10 KB — improvements now shipped)
       TEST-SCENARIOS.md           (17 KB internal QA planning)
       scripts/test-deterministic-fill.cjs  (orphan, no references)
   - Tightened .gitignore so future internal docs of these patterns
     (AUDIT-*.md, *.audit.md, *.planning.md, etc.) don't accumulate at
     the repo root again. They're all preserved in git history if anyone
     needs to reference them later.
   - Repo root now has only the standard open-source docs:
       README.md, LICENSE, NOTICE.md, CITATION.cff,
       CHANGELOG.md, CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md.

Desktop shortcut creation was already correct (verified in OpenAdKit.bat
PowerShell + OpenAdKit.command bash blocks); double-clicking the shortcut
now uses the new auto-start + auto-open-app flow.

Verified: tsc clean, 77/77 unit tests, next build clean, 48/48 Playwright
smoke pass against prod build.

Author: IamRamgarhia

.gitignore

@@ -27,6 +27,13 @@ NOTES.md
 TODO.md
 scratch/
 internal/
+AUDIT-*.md
+PRODUCT-AUDIT-*.md
+INSTALL-LAUNCH-*.md
+EXTERNAL-AUDIT-*.md
+TEST-SCENARIOS.md
+*.audit.md
+*.planning.md
 
 # Playwright artifacts
 test-results/