Add AI-assisted QA test workflow: scenario cards, runner, hooks, API capture

A complete loop for defining, generating, running and gating tests:

- qa/: scenario-card template + examples (API/UI/binding), the Claude
  generation prompt, and a QA runbook tying it together
- e2e/CLAUDE.md: conventions that keep AI-generated tests consistent
- run-tests.ps1: one runner for every layer (backend/api/web/ui/binding),
  logs per run under .testlogs/, JUnit output, evidence report, and a
  re-seed guard against stale demo data
- .githooks/ + scripts/install-hooks.ps1: pre-commit secret scan and
  pre-push unit tests (shift-left before CI)
- evidence report now captures each API call's request, payload and
  response (Authorization redacted); JUnit reporter added for CI
- scripts/db.mjs: db:check freshness guard

Azure DevOps pipeline deferred; the runner already emits JUnit + the
evidence report for any CI to publish.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/fixtures/test.ts

@@ -2,6 +2,7 @@ import { expect, test as base } from '@playwright/test';
 
 import { Account } from './accounts';
 import { Evidence } from './evidence';
+import { ApiCall, captureApiCall } from './http-capture';
 import { BookingDetailPage, BookingsPage } from '../pages/bookings.page';
 import { CheckoutPage } from '../pages/checkout.page';
 import { DashboardPage } from '../pages/dashboard.page';
@@ -26,6 +27,9 @@ interface Fixtures {
 
   /** Console and uncaught errors seen during the test; asserted empty at the end. */
   consoleErrors: string[];
+
+  /** Records every /api/** request and response for the run report. */
+  apiTraffic: void;
 }
 
 export const test = base.extend<Fixtures>({
@@ -75,6 +79,28 @@ export const test = base.extend<Fixtures>({
     },
     { auto: true },
   ],
+
+  // Records the request/response of every API call the test made, attached as
+  // evidence-http for the reporter. Auto, so no test has to opt in.
+  apiTraffic: [
+    async ({ page }, use, testInfo) => {
+      const pending: Array<Promise<ApiCall | null>> = [];
+      page.on('response', (response) => {
+        pending.push(captureApiCall(response));
+      });
+
+      await use();
+
+      const calls = (await Promise.all(pending)).filter((c): c is ApiCall => c !== null);
+      if (calls.length > 0) {
+        await testInfo.attach('evidence-http', {
+          body: Buffer.from(JSON.stringify(calls, null, 2), 'utf8'),
+          contentType: 'application/json',
+        });
+      }
+    },
+    { auto: true },
+  ],
 });
 
 export { expect } from '@playwright/test';