Fix markdown lint issues in README (107 IDE warnings -> 0)

- Auto-fix MD060 table column style, MD012 multiple blanks, MD031/MD032 list/fence spacing
- Add language tags to 4 bare code fences (MD040)
- Add .markdownlint.json disabling MD013 (wide tables/commands are intentional)
- Verified: markdownlint-cli2 reports 0 issues across README and docs/

.markdownlint.json

@@ -0,0 +1,5 @@
+{
+  // Line length is not enforced: this README uses wide tables and long
+  // inline-command lines that would be unreadable if wrapped.
+  "MD013": false
+}

README.md

@@ -105,6 +105,7 @@ chmod +x /usr/local/bin/wp-engine.sh
 
 > [!WARNING]
 > **Do not close your current SSH terminal** after running `--bootstrap`. Open a secondary terminal and verify that you can connect over your chosen port before disconnecting:
+>
 > ```bash
 > ssh -p <PORT> user@<HOST_IP>
 > ```
@@ -113,7 +114,7 @@ chmod +x /usr/local/bin/wp-engine.sh
 
 ## 4. CLI Reference & Options
 
-```
+```text
 Usage:
   Interactive Bootstrap:
     ./wp-engine.sh --bootstrap
@@ -176,13 +177,14 @@ Additional `create` examples:
 Installs `apt-transport-https ca-certificates curl gnupg lsb-release ufw fail2ban nftables openssl jq`.
 
 **`[2/6] Setting up Container Engine`**
+
 - *Docker:* adds Docker's official GPG key + apt repo, installs `docker-ce`, `docker-ce-cli`, `containerd.io`, `docker-buildx-plugin`, `docker-compose-plugin`, enables the service (skipped if Docker already present).
 - *Podman:* `apt-get install podman podman-compose podman-docker`, enables the service.
 
 **`[3/6] Hardening SSH on Port <port>`**
 Writes `/etc/ssh/sshd_config.d/99-hardened.conf`:
 
-```
+```text
 Port <chosen port>
 PermitRootLogin prohibit-password
 PasswordAuthentication yes
@@ -195,12 +197,14 @@ ClientAliveCountMax 2
 Also re-points `ssh.socket`'s `ListenStream` to the new port when socket activation is in use, then restarts SSH.
 
 **`[4/6] Configuring Firewall & Isolation Rules`**
+
 - UFW policy: **deny incoming / allow outgoing**.
 - Allowed inbound: SSH port, `80`, `443`, `3000` (Grafana), plus `81` if NPM or `8080` if Traefik.
 - For Docker, appends a **`DOCKER-USER` chain** to `/etc/ufw/after.rules` so UFW rules actually apply to container traffic (blocks direct SYN scans into `172.16.0.0/12`, rate-limited logging).
 - `ufw --force enable && ufw reload`.
 
 **`[5/6] Scaffolding Networks & Fail2ban Jails`**
+
 - Creates the directory skeleton (`/server/websites/{proxy,core,template,sites,monitoring}`).
 - Creates three external container networks: `proxy-net`, `shared-backend`, `monitoring-net`.
 - Writes Fail2ban jails:
@@ -347,7 +351,7 @@ High-level traffic flow (see `docs/` for the full Mermaid diagrams):
 
 ### Filesystem layout (`/server/websites/`)
 
-```
+```text
 /server/websites/
 ├── .engine-settings          # Persisted choices: ENGINE, PROXY_TYPE, SSH_PORT, GRAFANA_ADMIN_PASS
 ├── core/                     # Shared data tier
@@ -403,9 +407,11 @@ After bootstrap:
 
 1. Open `http://<HOST_IP>:3000` (Grafana).
 2. Log in with `admin` / the password generated during bootstrap and saved in the state file:
+
    ```bash
    grep GRAFANA_ADMIN_PASS /server/websites/.engine-settings
    ```
+
 3. The **Prometheus** datasource is pre-provisioned and set as default. Import dashboards via **Dashboards → Import** — recommended IDs:
 
    | ID | Dashboard | Provides |
@@ -608,10 +614,7 @@ Harness fixes (in `tests/smoke.sh`): Grafana/proxy assertions got 60 s retry win
 
 ## Repository Contents
 
-
-
-
-```
+```text
 wp-engine.sh                                   # The installer/provisioner script (executable)
 README.md                                      # This file
 .gitignore / .gitattributes                    # Secrets excluded; *.sh forced to LF
@@ -624,11 +627,3 @@ docs/
 │   Runtime_Architecture_Network_Topology.md   # Architecture & network Mermaid diagram
 │   Filesystem_and_Directory_Structure.md      # Filesystem layout Mermaid diagram
 ```
-
-
-
-
-
-
-
-