Add project guidance, security/governance/hygiene rules, and product wiki

- CLAUDE.md + AGENTS.md: canonical guiding principles for AI agents and
  developers (tenant isolation, no RLS, stack, security, conventions,
  environment gotchas)
- SECURITY.md: required security controls (isolation, secrets, auth,
  input handling, least privilege) with VAPT status
- GOVERNANCE.md: how changes are validated before merge — deterministic
  gates + AI review, risk tiers, human accountability
- CONTRIBUTING.md: code hygiene, definition of done, file hygiene
- docs/wiki/: product reference (overview, domain model, features,
  roles & access, API reference, glossary)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

AGENTS.md

@@ -0,0 +1,27 @@
+# AGENTS.md
+
+This project's guidance for AI coding agents lives in **[CLAUDE.md](CLAUDE.md)**.
+It is tool-agnostic — read it before generating or changing code here.
+
+Quick pointers:
+
+- **Guide (read first):** [CLAUDE.md](CLAUDE.md)
+- **Security rules:** [SECURITY.md](SECURITY.md)
+- **Governance rules:** [GOVERNANCE.md](GOVERNANCE.md)
+- **Contributing & hygiene:** [CONTRIBUTING.md](CONTRIBUTING.md)
+- **Product wiki:** [docs/wiki/](docs/wiki/README.md)
+- **Generating Playwright tests:** [e2e/CLAUDE.md](e2e/CLAUDE.md)
+- **QA scenario → test workflow:** [qa/README.md](qa/README.md)
+- **Testing overview:** [TESTING.md](TESTING.md)
+- **Security findings to respect:** [security/VAPT-REPORT.md](security/VAPT-REPORT.md)
+
+The non-negotiables, in one line each:
+
+1. Tenant isolation is enforced in the repository layer; tenant id comes from
+   the authenticated identity, every tenant query filters `tenant_id`, misses
+   return 404. **Do not add PostgreSQL RLS.**
+2. Never commit secrets; `.env` is git-ignored and read at runtime.
+3. A change isn't done until its tests pass and the evidence proves it; never
+   weaken an assertion.
+4. Stay in scope; a human owns the merge for anything tenant- or
+   security-sensitive.