chore: establish iteration 1 development baseline

docs/tests/README.md

@@ -0,0 +1,18 @@
+# Test Evidence
+
+TDD is mandatory. Every feature test must have one companion Markdown record
+in the directory matching its test type:
+
+- `unit/` — isolated state, calculation, and domain behavior.
+- `integration/` — PostgreSQL, Flyway, repository, transaction, and module integration.
+- `web/` — MockMvc, Thymeleaf, validation, and security behavior.
+- `e2e/` — cross-module, browser, or full user journeys.
+
+Copy that directory's `_TEMPLATE.md` and keep every heading. One evidence file
+may cover a cohesive parameterized scenario set, but it must name every
+requirement and scenario ID it protects.
+
+An evidence record is complete only when it contains the observed RED failure,
+the observed GREEN result, the affected-suite result, and honest external-test
+boundaries. Commands and relevant output are copied exactly; prose such as
+"passed locally" is not evidence.

docs/tests/e2e/_TEMPLATE.md

@@ -0,0 +1,59 @@
+# Test Evidence: <short behavior name>
+
+- **Test type:** E2E
+- **Requirement IDs:** `<ID>`
+- **Scenario IDs:** `<ID>`
+- **Test class/method:** `<fully qualified class and method>`
+- **Implementation commit:** `<short SHA or pending>`
+
+## Protected behavior
+
+<Externally observable rule and failure mode protected by this test.>
+
+## Test method
+
+<Setup, action, and assertions. Explain why this is the narrowest production-shaped test.>
+
+## Hand-derived expected result
+
+<Expected values or state derived independently of the implementation.>
+
+## RED
+
+**Command**
+
+```text
+<exact command>
+```
+
+**Observed result**
+
+```text
+<relevant failing output and why it failed for the expected missing behavior>
+```
+
+## GREEN
+
+**Command**
+
+```text
+<exact command>
+```
+
+**Observed result**
+
+```text
+<relevant passing output>
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+<exact broader command and result>
+```
+
+## External-test boundaries
+
+<What this test deliberately does not prove, including infrastructure or browser boundaries.>

docs/tests/integration/_TEMPLATE.md

@@ -0,0 +1,59 @@
+# Test Evidence: <short behavior name>
+
+- **Test type:** Integration
+- **Requirement IDs:** `<ID>`
+- **Scenario IDs:** `<ID>`
+- **Test class/method:** `<fully qualified class and method>`
+- **Implementation commit:** `<short SHA or pending>`
+
+## Protected behavior
+
+<Externally observable rule and failure mode protected by this test.>
+
+## Test method
+
+<Setup, action, and assertions. Explain why this is the narrowest production-shaped test.>
+
+## Hand-derived expected result
+
+<Expected values or state derived independently of the implementation.>
+
+## RED
+
+**Command**
+
+```text
+<exact command>
+```
+
+**Observed result**
+
+```text
+<relevant failing output and why it failed for the expected missing behavior>
+```
+
+## GREEN
+
+**Command**
+
+```text
+<exact command>
+```
+
+**Observed result**
+
+```text
+<relevant passing output>
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+<exact broader command and result>
+```
+
+## External-test boundaries
+
+<What this test deliberately does not prove, including infrastructure or browser boundaries.>

docs/tests/unit/_TEMPLATE.md

@@ -0,0 +1,59 @@
+# Test Evidence: <short behavior name>
+
+- **Test type:** Unit
+- **Requirement IDs:** `<ID>`
+- **Scenario IDs:** `<ID>`
+- **Test class/method:** `<fully qualified class and method>`
+- **Implementation commit:** `<short SHA or pending>`
+
+## Protected behavior
+
+<Externally observable rule and failure mode protected by this test.>
+
+## Test method
+
+<Setup, action, and assertions. Explain why this is the narrowest production-shaped test.>
+
+## Hand-derived expected result
+
+<Expected values or state derived independently of the implementation.>
+
+## RED
+
+**Command**
+
+```text
+<exact command>
+```
+
+**Observed result**
+
+```text
+<relevant failing output and why it failed for the expected missing behavior>
+```
+
+## GREEN
+
+**Command**
+
+```text
+<exact command>
+```
+
+**Observed result**
+
+```text
+<relevant passing output>
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+<exact broader command and result>
+```
+
+## External-test boundaries
+
+<What this test deliberately does not prove, including infrastructure or browser boundaries.>

docs/tests/web/_TEMPLATE.md

@@ -0,0 +1,59 @@
+# Test Evidence: <short behavior name>
+
+- **Test type:** Web
+- **Requirement IDs:** `<ID>`
+- **Scenario IDs:** `<ID>`
+- **Test class/method:** `<fully qualified class and method>`
+- **Implementation commit:** `<short SHA or pending>`
+
+## Protected behavior
+
+<Externally observable rule and failure mode protected by this test.>
+
+## Test method
+
+<Setup, action, and assertions. Explain why this is the narrowest production-shaped test.>
+
+## Hand-derived expected result
+
+<Expected values or state derived independently of the implementation.>
+
+## RED
+
+**Command**
+
+```text
+<exact command>
+```
+
+**Observed result**
+
+```text
+<relevant failing output and why it failed for the expected missing behavior>
+```
+
+## GREEN
+
+**Command**
+
+```text
+<exact command>
+```
+
+**Observed result**
+
+```text
+<relevant passing output>
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+<exact broader command and result>
+```
+
+## External-test boundaries
+
+<What this test deliberately does not prove, including infrastructure or browser boundaries.>