Add AI-assisted QA test workflow: scenario cards, runner, hooks, API capture

A complete loop for defining, generating, running and gating tests:

- qa/: scenario-card template + examples (API/UI/binding), the Claude
  generation prompt, and a QA runbook tying it together
- e2e/CLAUDE.md: conventions that keep AI-generated tests consistent
- run-tests.ps1: one runner for every layer (backend/api/web/ui/binding),
  logs per run under .testlogs/, JUnit output, evidence report, and a
  re-seed guard against stale demo data
- .githooks/ + scripts/install-hooks.ps1: pre-commit secret scan and
  pre-push unit tests (shift-left before CI)
- evidence report now captures each API call's request, payload and
  response (Authorization redacted); JUnit reporter added for CI
- scripts/db.mjs: db:check freshness guard

Azure DevOps pipeline deferred; the runner already emits JUnit + the
evidence report for any CI to publish.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

TESTING.md

@@ -290,8 +290,18 @@ invisibility, and the dashboard before and after a sale. Every other test still
 contributes its end-of-test screenshot automatically (`screenshot: 'on'`), so
 the report covers the whole run; the toolbar filters to the narrated ones.
 
-A typical full run produces **96 screenshots across 82 scenarios**, about 14 MB.
-The directory is git-ignored and CI keeps it as an artifact for 30 days.
+**API traffic.** Every scenario also records the request/response of every
+`/api/**` call it made — method, path, request headers, payload, status, and
+response body — shown as a collapsible "API calls" block under the scenario.
+This is automatic (an auto fixture in `fixtures/http-capture.ts`); no test has
+to opt in. The **`Authorization` header is redacted** before anything is stored
+— it carries the Basic-auth credential, and the report is meant to be shared.
+Response bodies are capped (12 KB) so a large flight list cannot bloat the
+report.
+
+A typical full run produces **96 screenshots and ~390 captured API calls across
+82 scenarios**, about 15 MB of HTML. The directory is git-ignored and CI keeps
+it as an artifact for 30 days.
 
 ### Simulated-condition tests