feat: open-source readiness — Apache 2.0, ETL refactor, CI scaffolding

[igor-ctrl]

Summary

Prepares the repo for public release. Bundles three threads of work:

1. License switch from MIT to Apache 2.0 (aligns with dlt, Airflow, Spark ecosystem; explicit patent grant helps enterprise adopters)
2. ETL refactor — splits the dlt source into a generic layer (usable for any BC tenant) and a bcli-aware bridge
3. Repo hygiene — GitHub scaffolding, OSS docs, clean references

What changed

License (chore: prepare repo for open-source release)

• LICENSE: MIT → Apache 2.0 (official text from apache.org)
• NOTICE added (required by Apache 2.0 §4(d))
• pyproject.toml: license = \"Apache-2.0\", classifier updated, project.urls added
• README shields (CI, license, Python versions)
• Added CONTRIBUTING.md, CODE_OF_CONDUCT.md (Contributor Covenant 2.1), SECURITY.md at root
• .github/:
  • workflows/tests.yml — pytest + ruff across Python 3.11/3.12/3.13
  • ISSUE_TEMPLATE/bug_report.md + feature_request.md
  • PULL_REQUEST_TEMPLATE.md
• Scrubbed all bc-cli references from README, CLAUDE.md, docs

ETL refactor (refactor: split bcli.etl into generic + bridge layers)

Before: src/bcli/etl/_source.py mixed generic dlt logic with bcli-specific defaults (registry dependency, always-on multi-company, always-on Fivetran stamping).

After:

```
src/bcli/etl/
├── _generic.py # business_central() factory, EntityDef — NO bcli imports
├── _client.py # minimal httpx + AuthProvider-based BC client
├── _auth.py # AuthProvider protocol + ClientCredentialsAuth + StaticTokenAuth
├── _stampers.py # fivetran_stamper, audit_stamper, company_id_stamper
└── _bridge.py # bcli_profile() — ONLY module importing bcli.*
```

The generic layer works with any BC tenant via explicit credentials + entity list:

```python
from bcli.etl import business_central, EntityDef, fivetran_stamper

source = business_central(
tenant_id="...", client_id="...", client_secret="...",
environment="Production",
entities=[EntityDef(name="customers")],
multi_company=True,
stampers=[fivetran_stamper()],
)
```

The bridge preserves today's Fivetran-parity defaults:

```python
from bcli.etl import bcli_profile
source = bcli_profile(profile="prod") # multi_company=True, fivetran_compat=True
```

Key design constraint: an AST-based test in tests/test_etl/test_generic.py fails the build if any generic-layer module imports from bcli.registry, bcli.client, bcli.config, bcli.auth, or bcli.errors.

Style (style: ruff auto-fixes)

Routine cleanup across src/ and tests/ — unused imports, redundant f-string prefixes, unused locals. No behavior changes.

CLI unchanged

`bcli etl sync` works exactly the same; the cron job on the server keeps producing identical output. The bridge preserves multi-company + Fivetran audit columns by default.

Stats

39 files changed, +1811 / −695

• 3 new modules (_generic, _client, _auth, _stampers, _bridge replace _source + _entities)
• 3 new test files (test_generic, test_bridge, test_stampers — 28 tests)
• 181 total tests passing
• Lint clean (`ruff check src/ tests/` — zero errors)

Test plan

• `uv run pytest tests/ -v` — 181 passed
• `uv run ruff check src/ tests/` — clean
• `uv run bcli --profile prod etl entities` — 114 entities listed
• Generic layer has no bcli coupling (AST-enforced test passes)
• `grep -rn bc-cli src/ docs/ README.md` — no matches
• `grep -rni beautech src/ tests/ README.md` — no matches
• Production cron unchanged — still syncs GL entries every 10 min

Follow-ups (out of scope for this PR)

• Replace the bridge's `bcli.AsyncBCClient` token fetch with a pure-MSAL call in the generic layer (once we're confident the AuthProvider shape is right)
• OData `$metadata` auto-discovery of entities
• Publish to PyPI as Apache 2.0

[cursor]

You have used all of your free Bugbot PR reviews.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.