Add CLAUDE.md and fix pre-existing failing tests

[suporterfid]

Summary

Adds a CLAUDE.md guidance file for future Claude Code sessions, and fixes 5 pre-existing failing tests that CI surfaced (unrelated to the docs but blocking a green build).

CLAUDE.md

Orients future sessions to the actual project — derived from README, scripts/tc.sh, composer.json, phpunit.xml, bootstrap/app.php, routes, provider bindings, and the app/ layering (no invented conventions):

• Docker-only workflow via the tc wrapper, including how to run a single backend/frontend test, and the CI steps to mirror locally.
• Layered architecture (Domain / Application / Infrastructure / Http), why Eloquent models live under app/Infrastructure/Persistence/Eloquent/, and where DI bindings + policies are wired.
• Multi-tenancy (Tenant → Environment → Task), the auth/tenant middleware, and isolation testing.
• Scheduler core (cron-driven scheduler:* commands, DB-backed claiming with lock + claim-token leases, at-least-once delivery, stale-claim recovery).
• Outbound SSRF safety, secrets redaction, and the Vue 3 frontend layout.

Test fixes

The baseline suite was failing 5/86; all now pass (86/86 locally). Each was a genuine defect, not a test workaround:

1. BootstrapFirstAdmin — ensureExists() read BOOTSTRAP_ADMIN_* via env(), but Laravel's cached env repository does not observe values exported into the process environment (putenv/deploy-time exports) after boot. Added a getenv() fallback so deploy-time env vars are honored. Fixes Phase0BootstrapAdminTest.
2. config/auth.php — the user provider still pointed at the default App\Models\User skeleton class while the app's canonical model is App\Infrastructure\Persistence\Eloquent\User. Password-reset notifications were therefore delivered to a different class than the app uses, breaking Notification::assertSentTo. Repointed the provider to the Infrastructure model. Fixes the member-invite notification test.
3. MemberFeatureTest — the three assertJsonValidationErrors calls used Laravel's default errors response key, but this API's ApiErrorRenderer nests validation errors under error.details. Pointed the assertions at the actual contract ('error.details'), matching how the rest of the API responds.

Verification

• php artisan test → 86 passed (was 5 failed / 81 passed).
• No frontend changes.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces CLAUDE.md, a guidance file for Claude Code detailing the project's architecture, Docker-only development environment, multi-tenancy structure, scheduler core loop, outbound HTTP safety, and secrets management. The review feedback points out a contradiction in the frontend testing instructions, where running npm directly on the host is suggested despite a strict Docker-only requirement, and recommends sticking exclusively to the containerized wrapper command.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The alternative command cd frontend && npm test contradicts the strict instruction in line 13: "Do not install or run PHP, Composer, Node, or npm on the host."

To maintain a strictly Docker-only workflow, we should avoid suggesting running npm directly on the host. Instead, we can suggest using the wrapper script from the frontend directory if supported, or stick exclusively to the root-level wrapper command.

Suggested change

	./scripts/tc.sh npm --prefix frontend run test # or: cd frontend && npm test
	./scripts/tc.sh npm --prefix frontend run test