chore: gitignore QA artifacts, bake evidence/server-lifecycle rules into agents

- Untrack .playwright-cli/ and ignore it + *.png; route QA artifacts to /tmp
- be/fe-implementer: require git status + test output + live smoke test in
  every report; never trust a running server, restart fresh; say so if
  unfinished (fixes the false-success-report failure mode from session 1)
- qa: adversarial stance (distrust self-reports, confirm features exist via
  /openapi.json), restart both servers + reset dev DB before testing, write
  expected numbers into scenarios
- Add HANDOFF.md and RETROSPECTIVE.md as session docs

.pi/agents/be-implementer.md

@@ -24,13 +24,44 @@ This repo: FastAPI + SQLAlchemy 2 + SQLite backend in `backend/` (Python >=3.12,
 - Run server: `cd backend && uv run uvicorn main:app --reload`
 - Background server: `cd backend && nohup uv run uvicorn main:app --host 0.0.0.0 --port 8000 &`
 
+## Completion discipline (non-negotiable)
+
+Implementers on this project have, in past sessions, reported success without
+actually writing code. To prevent that:
+
+- Your report is **invalid** unless it includes ALL of:
+  1. `git status --short` output showing the files you changed.
+  2. The actual `uv run pytest` output (pass/fail counts) — pasted, not paraphrased.
+  3. For any new/changed endpoint: a live smoke test with real `curl` output
+     against a freshly started server.
+- If you did not finish, SAY SO. A partial report is useful; a fabricated one
+  is worse than useless and will be caught by QA.
+- Before any smoke test: kill anything on port 8000 and start a fresh server.
+  Never trust an already-running uvicorn to be current — stale servers served
+  old code and caused false 405s in prior sessions:
+  ```bash
+  pkill -f "uvicorn main:app" 2>/dev/null; sleep 1
+  cd backend && nohup uv run uvicorn main:app --host 0.0.0.0 --port 8000 &
+  sleep 2
+  ```
+- Reset the dev DB when a clean state is needed:
+  `rm -f backend/calcount.db` (migrations recreate the schema on startup).
+- The `.venv/`, `*.db`, and `.playwright-cli/` dirs are gitignored — never
+  commit them. Run `git status` before reporting to confirm only real source
+  files are staged/changed.
+
 ## Output format
 
 ### Completed
-What was done.
+What was done, and which acceptance criteria are met.
 
 ### Files Changed
 - `path/to/file.py` — summary
 
+### Evidence
+- `git status --short` output (pasted)
+- `uv run pytest` output (pasted, with pass/fail counts)
+- Smoke-test `curl` output for any new/changed endpoint
+
 ### Notes (if any)
-Anything the caller should know.
+Anything the caller should know — including anything you did NOT finish.