Add project guidance, security/governance/hygiene rules, and product wiki

- CLAUDE.md + AGENTS.md: canonical guiding principles for AI agents and
  developers (tenant isolation, no RLS, stack, security, conventions,
  environment gotchas)
- SECURITY.md: required security controls (isolation, secrets, auth,
  input handling, least privilege) with VAPT status
- GOVERNANCE.md: how changes are validated before merge — deterministic
  gates + AI review, risk tiers, human accountability
- CONTRIBUTING.md: code hygiene, definition of done, file hygiene
- docs/wiki/: product reference (overview, domain model, features,
  roles & access, API reference, glossary)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/wiki/06-glossary.md

@@ -0,0 +1,22 @@
+# Glossary
+
+| Term | Meaning |
+| ---- | ------- |
+| **Tenant** | One travel agency using the platform. The owner of all tenant-scoped data. Identified by a `slug` (e.g. `skyline`). |
+| **Agency** | The user-facing word for a tenant. |
+| **Agent** | Agency staff member who searches, books and manages reservations. |
+| **Admin** | Agency staff member with (intended) administration rights on top of agent capabilities. |
+| **Tenant isolation** | The guarantee that one tenant cannot see or affect another's data. Enforced in the application layer. |
+| **PNR / Booking reference** | The 6-character code identifying a booking (e.g. `QX7A2M`). Unique within a tenant. |
+| **Flight (inventory)** | A sellable route on a date at a fare with a seat count, owned by one tenant. The same physical route is a separate row per tenant. |
+| **Cabin class** | `economy`, `premium_economy`, `business`, or `first`. |
+| **Seats available / total** | Remaining and original seats on a flight. Bookings decrement available; cancellations restore it. |
+| **Oversell** | Selling more seats than exist. Prevented by a row-locked transaction at booking time. |
+| **IATA code** | Standard airport (3-letter, e.g. `JFK`) or airline (2-letter, e.g. `AA`) code. |
+| **Reference data** | Global, non-tenant data: airports and airlines, shared by all tenants. |
+| **X-Tenant** | The HTTP header naming which agency a request is for (or taken from the subdomain). |
+| **Basic auth** | The authentication scheme: `Authorization: Basic base64(email:password)`, verified within the named tenant. |
+| **Suspended tenant** | An agency whose users cannot sign in and which is hidden from the agency picker. |
+| **Evidence report** | The e2e test report showing screenshots and the API request/response for each scenario (`e2e/evidence-report/`). |
+| **Scenario card** | A structured definition of one test scenario in `qa/scenarios/`; the source a Playwright test is generated from. |
+| **Binding (test layer)** | A test of the seam between layers — that the UI sends what the API expects and renders what it returns. |