Add project guidance, security/governance/hygiene rules, and product wiki

- CLAUDE.md + AGENTS.md: canonical guiding principles for AI agents and
  developers (tenant isolation, no RLS, stack, security, conventions,
  environment gotchas)
- SECURITY.md: required security controls (isolation, secrets, auth,
  input handling, least privilege) with VAPT status
- GOVERNANCE.md: how changes are validated before merge — deterministic
  gates + AI review, risk tiers, human accountability
- CONTRIBUTING.md: code hygiene, definition of done, file hygiene
- docs/wiki/: product reference (overview, domain model, features,
  roles & access, API reference, glossary)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/wiki/03-features.md

@@ -0,0 +1,58 @@
+# Features
+
+The agent console, screen by screen. Each maps to a feature area used in the
+test suite and the evidence report.
+
+## Sign in
+
+- The agency picker lists active tenants (the only unauthenticated read).
+- The agent chooses an agency, then enters credentials. The same email/password
+  is only valid against the agency it was issued for — valid credentials aimed
+  at the wrong agency are rejected.
+- Demo-account shortcuts fill the form for quick access (see
+  [Roles & access](04-roles-and-access.md)).
+- Sessions survive a reload (credentials held client-side) but not a sign-out;
+  stale credentials are discarded and the user returned to sign-in.
+
+## Search flights
+
+- Filter the agency's inventory by **origin/destination** (IATA), **date**,
+  **cabin**, and **number of travellers**.
+- Dropdowns offer only the airports the agency actually flies.
+- Sort by **lowest fare**, **shortest trip**, or **earliest departure**.
+- Results are paged; each card shows carrier, times (with a +1 for overnight
+  arrivals), duration, fare, cabin, and seats remaining (scarce inventory is
+  flagged). Only future, non-cancelled flights with enough seats appear.
+
+## Checkout & booking
+
+- Selecting a flight opens checkout with the fare carried over.
+- Enter one or more travellers (up to 9) and contact details; the total reprices
+  live as travellers change.
+- Confirming creates the booking and shows a confirmation with the **PNR**.
+- Guardrails: the party can't exceed remaining seats; a seat sold while the form
+  was open surfaces as a clear "just sold" message (409), not an oversell.
+
+## Bookings
+
+- List every reservation the agency has sold, filterable by status
+  (confirmed/cancelled), newest first.
+- Open a booking to see its full itinerary, travellers, totals and contact.
+- **Cancel** a booking (two-step confirm); the seats return to inventory. A
+  cancelled booking still appears in the list, marked cancelled.
+
+## Dashboard
+
+- The agency's trading position: total revenue, confirmed/cancelled bookings,
+  seats sold, future flights in stock.
+- Best-selling routes and the most recent bookings.
+- All figures are strictly per-agency; a sale moves them and a cancellation
+  moves them back.
+
+## Cross-cutting
+
+- **Multi-tenant throughout:** every screen shows only the signed-in agency's
+  data; the sidebar always names the current agency.
+- **Responsive:** works at desk and phone width; no horizontal scrolling.
+- **Observable correctness:** the e2e suite captures screenshots and the API
+  request/response behind each of these flows into the evidence report.