Add project guidance, security/governance/hygiene rules, and product wiki

- CLAUDE.md + AGENTS.md: canonical guiding principles for AI agents and
  developers (tenant isolation, no RLS, stack, security, conventions,
  environment gotchas)
- SECURITY.md: required security controls (isolation, secrets, auth,
  input handling, least privilege) with VAPT status
- GOVERNANCE.md: how changes are validated before merge — deterministic
  gates + AI review, risk tiers, human accountability
- CONTRIBUTING.md: code hygiene, definition of done, file hygiene
- docs/wiki/: product reference (overview, domain model, features,
  roles & access, API reference, glossary)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/wiki/01-overview.md

@@ -0,0 +1,49 @@
+# Overview
+
+## What TravelHub is
+
+TravelHub is a **multi-tenant flight-booking platform** in the travel domain. It
+serves travel agencies: each agency's staff use it to search flight inventory,
+sell tickets to travellers, and manage the resulting bookings. It is built as a
+reference implementation of a secure, multi-tenant full-stack application.
+
+- **Frontend:** Angular single-page app (the agent console).
+- **Backend:** Go HTTP API.
+- **Database:** PostgreSQL.
+- **Auth:** HTTP Basic, scoped per tenant.
+
+## The multi-tenant model
+
+A **tenant** is one travel agency. Many tenants share a single deployment and a
+single database. The central product promise: **no tenant can see another
+tenant's data** — not its flights, not its customers, not its revenue, not even
+whether a given booking exists.
+
+Storage uses a **shared database, shared schema, `tenant_id` discriminator**:
+every tenant-owned row carries the id of the tenant that owns it. Reference data
+that is genuinely global — airports and airlines — is shared and has no tenant.
+
+Isolation is enforced in the **application layer**: the tenant is derived from
+who you authenticated as, and every query is scoped to that tenant. (This is a
+deliberate design choice; PostgreSQL row-level security is intentionally not
+used — see [CLAUDE.md](../../CLAUDE.md).)
+
+### What makes isolation visible
+
+The two seeded demo agencies carry the **same routes at different fares** —
+Skyline at list price, Globetrotter at a negotiated markup — and different
+availability. Signing in as each and searching the same route shows different
+results. That contrast is the product's isolation made tangible, not an
+accident of the demo data.
+
+## Who uses it
+
+Agency staff in two roles — **admin** and **agent** (see
+[Roles & access](04-roles-and-access.md)). There is no traveller-facing
+self-service; a traveller is a passenger on a booking an agent makes.
+
+## What it deliberately is not (yet)
+
+A booking is a single one-way flight. Round trips, seat maps, ancillaries,
+payment capture, ticketing, and tenant self-signup are out of scope for this
+reference build.