Add AI-assisted QA test workflow: scenario cards, runner, hooks, API capture

A complete loop for defining, generating, running and gating tests:

- qa/: scenario-card template + examples (API/UI/binding), the Claude
  generation prompt, and a QA runbook tying it together
- e2e/CLAUDE.md: conventions that keep AI-generated tests consistent
- run-tests.ps1: one runner for every layer (backend/api/web/ui/binding),
  logs per run under .testlogs/, JUnit output, evidence report, and a
  re-seed guard against stale demo data
- .githooks/ + scripts/install-hooks.ps1: pre-commit secret scan and
  pre-push unit tests (shift-left before CI)
- evidence report now captures each API call's request, payload and
  response (Authorization redacted); JUnit reporter added for CI
- scripts/db.mjs: db:check freshness guard

Azure DevOps pipeline deferred; the runner already emits JUnit + the
evidence report for any CI to publish.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

qa/generate-test.prompt.md

@@ -0,0 +1,45 @@
+# Prompt template — generate a Playwright test from a scenario card
+
+Paste this into Claude Code (from the repo root), filling in the card id.
+Claude has the repo in context, so it will read the card and the conventions
+itself.
+
+---
+
+Generate the automated test for scenario card `qa/scenarios/<ID>.yml`.
+
+Follow `e2e/CLAUDE.md` exactly. In particular:
+
+- Put the test in the spec file for the card's `area`; add to the existing
+  `test.describe` block, do not create a new spec.
+- Drive the UI only through the page objects in `e2e/pages/`. If a needed action
+  or locator is missing, add a method to the right page object and use it.
+- Import `test`/`expect` from `../fixtures/test`; take accounts from
+  `e2e/fixtures/accounts.ts`.
+- For every clause under the card's `then:` and every item under `evidence:`,
+  add an `evidence.step(name, { ...observed data })` capturing a screenshot and
+  the figures the card asks for.
+- No raw selectors in the spec, no `waitForTimeout`, no hardcoded secrets.
+- If the test creates data (a booking), clean it up at the end.
+
+When done:
+
+1. Show me the diff (the spec, and any page-object change).
+2. Run it: `.\run-tests.ps1 -Layer <layer> -Grep "<title fragment>" -Open`.
+3. Confirm the evidence report shows each screenshot and the API
+   request/response listed in the card's `evidence:` section.
+
+Do not loosen any assertion to make it pass. If the application behaves
+differently from the card, stop and tell me what differs — that is a finding,
+not something to code around.
+
+---
+
+## Reviewer checklist (the human reading the diff)
+
+- [ ] Test lives in the right area spec; uses page objects, no raw selectors.
+- [ ] Every `then` has a matching assertion on observable state.
+- [ ] Evidence steps cover everything the card listed.
+- [ ] No `waitForTimeout`, no hardcoded credentials, no weakened assertions.
+- [ ] It actually ran green, and the evidence report proves the scenario.
+- [ ] Data created by the test is cleaned up.