Add AI-assisted QA test workflow: scenario cards, runner, hooks, API capture

A complete loop for defining, generating, running and gating tests:

- qa/: scenario-card template + examples (API/UI/binding), the Claude
  generation prompt, and a QA runbook tying it together
- e2e/CLAUDE.md: conventions that keep AI-generated tests consistent
- run-tests.ps1: one runner for every layer (backend/api/web/ui/binding),
  logs per run under .testlogs/, JUnit output, evidence report, and a
  re-seed guard against stale demo data
- .githooks/ + scripts/install-hooks.ps1: pre-commit secret scan and
  pre-push unit tests (shift-left before CI)
- evidence report now captures each API call's request, payload and
  response (Authorization redacted); JUnit reporter added for CI
- scripts/db.mjs: db:check freshness guard

Azure DevOps pipeline deferred; the runner already emits JUnit + the
evidence report for any CI to publish.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/install-hooks.ps1

@@ -0,0 +1,17 @@
+#requires -Version 5.1
+# Point git at the versioned hooks in .githooks so every developer gets the
+# same pre-commit / pre-push gates. Run once after cloning.
+$ErrorActionPreference = 'Stop'
+$root = Split-Path $PSScriptRoot -Parent
+Push-Location $root
+try {
+    git config core.hooksPath .githooks
+    # Git for Windows runs hooks via its bundled bash; the files are sh scripts.
+    Write-Host 'Git hooks installed (core.hooksPath -> .githooks):' -ForegroundColor Green
+    Write-Host '  pre-commit : blocks committed secrets'
+    Write-Host '  pre-push   : runs backend + web unit tests'
+    Write-Host ''
+    Write-Host 'Bypass in an emergency with --no-verify (discouraged).'
+} finally {
+    Pop-Location
+}