Add AI-assisted QA test workflow: scenario cards, runner, hooks, API capture

A complete loop for defining, generating, running and gating tests:

- qa/: scenario-card template + examples (API/UI/binding), the Claude
  generation prompt, and a QA runbook tying it together
- e2e/CLAUDE.md: conventions that keep AI-generated tests consistent
- run-tests.ps1: one runner for every layer (backend/api/web/ui/binding),
  logs per run under .testlogs/, JUnit output, evidence report, and a
  re-seed guard against stale demo data
- .githooks/ + scripts/install-hooks.ps1: pre-commit secret scan and
  pre-push unit tests (shift-left before CI)
- evidence report now captures each API call's request, payload and
  response (Authorization redacted); JUnit reporter added for CI
- scripts/db.mjs: db:check freshness guard

Azure DevOps pipeline deferred; the runner already emits JUnit + the
evidence report for any CI to publish.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.githooks/pre-commit

@@ -0,0 +1,45 @@
+#!/bin/sh
+# Fast, local shift-left gate: block obvious secrets from being committed.
+# Runs in seconds, needs no toolchain. Enable with: scripts/install-hooks.ps1
+#
+# Bypass in a genuine emergency with: git commit --no-verify  (discouraged).
+
+staged=$(git diff --cached --name-only --diff-filter=ACM)
+[ -z "$staged" ] && exit 0
+
+fail=0
+report() { echo "  BLOCKED: $1"; fail=1; }
+
+for f in $staged; do
+  # Skip the hook scripts themselves: they legitimately contain the patterns
+  # (and literals) they search for, so scanning them would self-block.
+  case "$f" in
+    .githooks/*) continue;;
+  esac
+
+  # Never commit a real env file (only .env.example is allowed).
+  case "$f" in
+    *.env|.env) report "$f looks like a secrets file (.env is git-ignored for a reason)";;
+  esac
+
+  # Scan staged content for credential patterns.
+  [ -f "$f" ] || continue
+  content=$(git show ":$f" 2>/dev/null) || continue
+
+  echo "$content" | grep -Eq 'GITEA_TOKEN[[:space:]]*=[[:space:]]*[A-Za-z0-9]' && \
+    report "$f contains a GITEA_TOKEN value"
+  echo "$content" | grep -Eq 'PGPASSWORD[[:space:]]*=[[:space:]]*[^ \"$]' && \
+    report "$f hardcodes PGPASSWORD"
+  echo "$content" | grep -q 'BEGIN .*PRIVATE KEY' && \
+    report "$f contains a private key"
+  # The known dev DB password must never re-enter the tree (see VAPT FINDING-8).
+  echo "$content" | grep -q 'Did10n@c' && \
+    report "$f contains the real dev DB password"
+done
+
+if [ "$fail" -ne 0 ]; then
+  echo ""
+  echo "Commit blocked: remove the secret(s) above, or use .env (git-ignored)."
+  exit 1
+fi
+exit 0

.githooks/pre-push

@@ -0,0 +1,20 @@
+#!/bin/sh
+# Pre-push gate: run the fast test layers (Go + Angular unit) before code leaves
+# the machine. The browser e2e suite is left for CI to keep push quick.
+#
+# Bypass in a genuine emergency with: git push --no-verify  (discouraged).
+
+echo "pre-push: running unit layers (backend + web) ..."
+
+# Delegate to the one runner so local and CI behave identically. The ps1
+# refreshes PATH itself, so this works even in a terminal opened before the
+# toolchain was installed.
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File ./run-tests.ps1 -Layer unit -NoReport
+code=$?
+
+if [ "$code" -ne 0 ]; then
+  echo ""
+  echo "pre-push blocked: unit tests failed. Fix them, or push --no-verify to override."
+  exit 1
+fi
+exit 0