Add AI-assisted QA test workflow: scenario cards, runner, hooks, API capture

A complete loop for defining, generating, running and gating tests:

- qa/: scenario-card template + examples (API/UI/binding), the Claude
  generation prompt, and a QA runbook tying it together
- e2e/CLAUDE.md: conventions that keep AI-generated tests consistent
- run-tests.ps1: one runner for every layer (backend/api/web/ui/binding),
  logs per run under .testlogs/, JUnit output, evidence report, and a
  re-seed guard against stale demo data
- .githooks/ + scripts/install-hooks.ps1: pre-commit secret scan and
  pre-push unit tests (shift-left before CI)
- evidence report now captures each API call's request, payload and
  response (Authorization redacted); JUnit reporter added for CI
- scripts/db.mjs: db:check freshness guard

Azure DevOps pipeline deferred; the runner already emits JUnit + the
evidence report for any CI to publish.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/playwright.config.ts

@@ -22,9 +22,22 @@ export default defineConfig({
 
   // The evidence reporter turns the screenshots and data captured by passing
   // tests into a readable run report; the html one stays for debugging failures.
+  // junit.xml is the machine-readable result any CI (Azure DevOps, Gitea) can
+  // ingest; the evidence reporter is the human record; html is for debugging.
   reporter: process.env.CI
-    ? [['github'], ['html', { open: 'never' }], ['./reporters/evidence.ts'], ['list']]
-    : [['html', { open: 'never' }], ['./reporters/evidence.ts'], ['list']],
+    ? [
+        ['github'],
+        ['junit', { outputFile: 'results/junit.xml' }],
+        ['html', { open: 'never' }],
+        ['./reporters/evidence.ts'],
+        ['list'],
+      ]
+    : [
+        ['junit', { outputFile: 'results/junit.xml' }],
+        ['html', { open: 'never' }],
+        ['./reporters/evidence.ts'],
+        ['list'],
+      ],
 
   use: {
     baseURL: WEB,