feat: initial itpp-docs setup with MkDocs Material

- mkdocs.yml with dark slate theme, nav for 12 ITPP projects
- build-docs.sh aggregates docs from all project repos
- .gitea/workflows/docs-publish.yml for nightly rebuild+deploy
- README and CHANGELOG for the itpp-docs repo itself
- docs-source/ populated from all 12 repos
- site/ ready for deployment to docs.itpropartner.com

docs-source/itpp-infrastructure/super-search-cf-bypass.md

@@ -0,0 +1,64 @@
+# Super Search — Cloudflare Bypass
+
+**Added:** July 21, 2026
+**Version:** 2.1.0
+
+## Extraction Chain
+
+| Tier | Provider | What it handles | Fallback Trigger |
+|---|---|---|---|
+| 1 | Trafilatura | Normal sites | Error OR CF challenge detected |
+| 2 | Browserless Chrome | CF-protected sites | Chrome render + Trafilatura |
+| 3 | Firecrawl | Everything else | API-based extraction |
+
+## CF Detection
+Nine detection markers for caught challenge pages (from Hound's code + additional):
+- cf-turnstile, challenges.cloudflare.com/turnstile
+- cf_chl_opt, __cf_chl
+- cf-browser-verification, challenge-platform, cf-mitigated
+- "Checking your browser", "Just a moment"
+
+## Infrastructure
+- Browserless Chrome on app1 (152.53.36.131), port 3005
+- Caddy proxy: app1:3006 → localhost:3005
+- Firewall: only Core (152.53.192.33) can reach port 3006
+- Super Search: `/root/docker/super-search/server.py`
+
+## Verify
+```bash
+# Test CF bypass
+cd /root/docker/super-search && source venv/bin/activate
+python3 -c "
+from server import _extract_one
+import asyncio
+r = asyncio.run(_extract_one('https://nowsecure.nl'))
+print(r['provider'])  # Should be 'trafilatura' or 'browserless'
+"
+```
+
+---
+
+## v2.1 Features (Added July 21, 2026)
+
+### 13 Tools
+| # | Tool | Description |
+|---|---|---|
+| 1-10 | Original 10 | Search, extract, lookup, suggest, images |
+| 11 | `web_search_fast` | Parallel racing: all providers fire simultaneously |
+| 12 | `screenshot` | Browserless Chrome → base64 PNG |
+| 13 | `circuit_status` | Provider health states (closed/open/half-open) |
+
+### Circuit Breaker
+- 8 provider circuits: 3 failures → open for 60s
+- Prevents hammering dead providers
+- Auto-recovers when provider comes back
+
+### Parallel Racing
+- `web_search_fast`: SearXNG ∥ Exa ∥ DuckDuckGo ∥ Wikipedia
+- First successful result wins — others cancelled
+- Typically 2-3x faster than sequential fallback
+
+### Screenshot
+- Browserless Chrome on port 3006 (Caddy HTTP proxy)
+- Full-page or viewport capture
+- Base64-encoded PNG in JSON response