Add AI-assisted QA test workflow: scenario cards, runner, hooks, API capture

A complete loop for defining, generating, running and gating tests:

- qa/: scenario-card template + examples (API/UI/binding), the Claude
  generation prompt, and a QA runbook tying it together
- e2e/CLAUDE.md: conventions that keep AI-generated tests consistent
- run-tests.ps1: one runner for every layer (backend/api/web/ui/binding),
  logs per run under .testlogs/, JUnit output, evidence report, and a
  re-seed guard against stale demo data
- .githooks/ + scripts/install-hooks.ps1: pre-commit secret scan and
  pre-push unit tests (shift-left before CI)
- evidence report now captures each API call's request, payload and
  response (Authorization redacted); JUnit reporter added for CI
- scripts/db.mjs: db:check freshness guard

Azure DevOps pipeline deferred; the runner already emits JUnit + the
evidence report for any CI to publish.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/reporters/report-model.ts

@@ -15,6 +15,19 @@ export interface Step {
   facts?: Record<string, unknown>;
 }
 
+/** One API request/response pair observed during a scenario. */
+export interface ApiCall {
+  method: string;
+  path: string;
+  status: number;
+  statusText: string;
+  durationMs: number;
+  requestHeaders: Record<string, string>;
+  requestBody?: string;
+  responseBody?: string;
+  truncated?: boolean;
+}
+
 /** One test, as the report talks about it. */
 export interface Scenario {
   project: string;
@@ -25,6 +38,7 @@ export interface Scenario {
   expected: boolean;
   durationMs: number;
   steps: Step[];
+  apiCalls: ApiCall[];
   error?: string;
 }
 
@@ -45,6 +59,7 @@ export interface Summary {
   skipped: number;
   narrated: number;
   screenshots: number;
+  apiCalls: number;
 }
 
 // --- areas -----------------------------------------------------------------