docs: update documentation for Phase 3.6 features

Update README.md and SESSION_CONTEXT.md to reflect recent changes:

Phase 3.6 features:
- Cloudflare Turnstile CAPTCHA (registration & contact form)
- Cloudflare TURN/STUN servers for WebRTC
- Public profiles accessible without authentication
- Static content pages (About Us, How It Works)
- Contact form with admin panel
- 404 page with activity logging
- Responsive mobile design improvements
- Trust proxy configuration

Testing updates:
- 351 tests (up from 342), 100% passing
- 73% coverage (up from 72.5%)
- New webrtc-api.test.js with 9 comprehensive tests
- 100% coverage for routes/webrtc.js

Structure updates:
- New routes: /api/webrtc/ice-servers, /api/public/contact
- New admin pages: ContactMessagesPage
- Static content in frontend/public/content/
- Enhanced navbar with admin dropdown

docs/SESSION_CONTEXT.md

@@ -15,17 +15,20 @@
 
 ## Current Status
 
-**Phase:** MVP Complete - Production Ready
-**Tests:** 342/342 backend tests passing - 100% ✅ (72.5% coverage)
-**Recent Work:** Activity Log System with real-time admin dashboard (Phase 3.5 complete)
+**Phase:** MVP Complete - Production Ready (Phase 3.6 complete)
+**Tests:** 351/351 backend tests passing - 100% ✅ (73% coverage)
+**Recent Work:** Cloudflare integrations (CAPTCHA, TURN/STUN), public pages, responsive design improvements
 
 ### Core Features (All Implemented)
 - JWT authentication with email verification (AWS SES)
+- Cloudflare Turnstile CAPTCHA (bot protection on registration & contact form)
 - Real-time chat (Socket.IO) - event rooms + private 1:1
   - Real-time active users with instant updates
   - Message validation (2000 char limit with visual counter)
   - Spam protection (rate limiting, duplicate detection, profanity filter)
 - WebRTC P2P file transfer (RTCDataChannel, up to 700MB tested)
+  - Cloudflare TURN/STUN servers with dynamic configuration
+  - Fallback to public STUN servers
 - Competition heats system for matchmaking
 - Recording matching system with 3-tier account system (BASIC/SUPPORTER/COMFORT)
 - Fairness algorithm (karma tracking: recordingsDone vs recordingsReceived)
@@ -34,11 +37,16 @@
 - Incremental matching (preserves accepted/completed suggestions)
 - Scheduler integration (automated matching with cron)
 - Atomic stats updates with race condition prevention
-- Clickable usernames with @ prefix, country flags
+- Clickable usernames in navbar, country flags
+- Public profiles (/u/{username}) - accessible without authentication
+- Static content pages (About Us, How It Works) - markdown-based
+- Contact form with admin panel
+- 404 page with activity logging
 - Matches & ratings API
 - QR code event check-in
 - PWA (offline support, iOS compatible)
-- Security: CSRF, rate limiting, account lockout
+- Responsive mobile design
+- Security: CSRF, rate limiting, account lockout, trust proxy
 - Test bot for automated testing
 - Activity Log System - admin monitoring dashboard with real-time streaming (18 action types)
 
@@ -49,27 +57,30 @@
 ```
 /spotlightcam
 ├── docker-compose.yml       # nginx:8080 + frontend + backend + db
-├── frontend/src/
-│   ├── pages/               # React pages
-│   │   └── admin/           # Admin pages (ActivityLogsPage.jsx)
-│   ├── components/          # Reusable components
-│   ├── contexts/            # AuthContext
-│   ├── services/            # api.js, socket.js
-│   ├── hooks/               # useWebRTC.js
-│   └── constants/           # MATCH_STATUS, SUGGESTION_STATUS, etc.
+├── frontend/
+│   ├── public/content/      # Static markdown content (about-us.md, how-it-works.md)
+│   └── src/
+│       ├── pages/           # React pages (Home, Profile, Contact, 404, AboutUs, HowItWorks)
+│       │   └── admin/       # Admin pages (ActivityLogsPage.jsx, ContactMessagesPage.jsx)
+│       ├── components/      # Reusable components
+│       ├── contexts/        # AuthContext
+│       ├── services/        # api.js, socket.js, webrtcAPI
+│       ├── hooks/           # useWebRTC.js (Cloudflare TURN)
+│       └── constants/       # MATCH_STATUS, SUGGESTION_STATUS, etc.
 ├── backend/src/
-│   ├── routes/              # API endpoints (events.js, matches.js, admin.js)
+│   ├── routes/              # API endpoints (events.js, matches.js, admin.js, webrtc.js, public.js)
 │   ├── controllers/         # Business logic
 │   ├── services/            # matching.js (auto-matching), activityLog.js (audit trail)
 │   ├── middleware/          # auth.js, admin.js (requireAdmin)
 │   ├── socket/              # Socket.IO handlers (chat, WebRTC, admin logs)
 │   ├── utils/               # request.js (IP extraction)
 │   ├── constants/           # Status constants
-│   └── __tests__/           # Jest tests (342 tests - 100% passing)
+│   └── __tests__/           # Jest tests (351 tests - 100% passing)
 │       ├── matching-algorithm.test.js      # 19 tests
 │       ├── ratings-stats-flow.test.js      # 9 tests
 │       ├── matching-runs-audit.test.js     # 6 tests
 │       ├── matching-incremental.test.js    # 5 tests
+│       ├── webrtc-api.test.js              # 9 tests (Cloudflare TURN)
 │       └── socket.test.js                  # 12 tests
 └── docs/
     ├── SESSION_CONTEXT.md   # This file - quick context