Add project guidance, security/governance/hygiene rules, and product wiki

- CLAUDE.md + AGENTS.md: canonical guiding principles for AI agents and
  developers (tenant isolation, no RLS, stack, security, conventions,
  environment gotchas)
- SECURITY.md: required security controls (isolation, secrets, auth,
  input handling, least privilege) with VAPT status
- GOVERNANCE.md: how changes are validated before merge — deterministic
  gates + AI review, risk tiers, human accountability
- CONTRIBUTING.md: code hygiene, definition of done, file hygiene
- docs/wiki/: product reference (overview, domain model, features,
  roles & access, API reference, glossary)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/wiki/README.md

@@ -0,0 +1,24 @@
+# TravelHub product wiki
+
+The product reference for TravelHub — what it is, how it is modelled, and how it
+behaves. For engineering conventions see [CLAUDE.md](../../CLAUDE.md); for
+running and testing see [TESTING.md](../../TESTING.md) and
+[qa/README.md](../../qa/README.md).
+
+## Pages
+
+1. [Overview](01-overview.md) — what TravelHub is and the multi-tenant model
+2. [Domain model](02-domain-model.md) — entities, relationships, the data model
+3. [Features](03-features.md) — capabilities, screen by screen
+4. [Roles & access](04-roles-and-access.md) — admin/agent, auth, demo accounts
+5. [API reference](05-api-reference.md) — endpoints and contracts
+6. [Glossary](06-glossary.md) — domain terms
+
+## In one paragraph
+
+TravelHub is a multi-tenant flight-booking platform for travel agencies. Several
+agencies ("tenants") share one deployment and one database, but each sees only
+its own inventory, customers and revenue. An agency's staff sign in, search the
+agency's flight inventory, sell tickets, manage and cancel bookings, and see a
+trading dashboard. It is built as a reference sample: Angular SPA, Go API,
+PostgreSQL, with strict per-tenant isolation.