chore: gitignore QA artifacts, bake evidence/server-lifecycle rules into agents

- Untrack .playwright-cli/ and ignore it + *.png; route QA artifacts to /tmp
- be/fe-implementer: require git status + test output + live smoke test in
  every report; never trust a running server, restart fresh; say so if
  unfinished (fixes the false-success-report failure mode from session 1)
- qa: adversarial stance (distrust self-reports, confirm features exist via
  /openapi.json), restart both servers + reset dev DB before testing, write
  expected numbers into scenarios
- Add HANDOFF.md and RETROSPECTIVE.md as session docs

.gitignore

@@ -6,6 +6,10 @@ __pycache__/
 # App data
 *.db
 
+# QA / playwright artifacts (keep these OUT of the repo; use /tmp instead)
+.playwright-cli/
+*.png
+
 # Node / Vite
 node_modules/
 dist/