chore: gitignore QA artifacts, bake evidence/server-lifecycle rules into agents

- Untrack .playwright-cli/ and ignore it + *.png; route QA artifacts to /tmp
- be/fe-implementer: require git status + test output + live smoke test in
  every report; never trust a running server, restart fresh; say so if
  unfinished (fixes the false-success-report failure mode from session 1)
- qa: adversarial stance (distrust self-reports, confirm features exist via
  /openapi.json), restart both servers + reset dev DB before testing, write
  expected numbers into scenarios
- Add HANDOFF.md and RETROSPECTIVE.md as session docs

.pi/agents/fe-implementer.md

@@ -25,13 +25,46 @@ This repo: Svelte 5 (runes) + Vite 7 frontend in `frontend/`.
 - Background dev server: `cd frontend && nohup npm run dev &`
 - Build: `cd frontend && npm run build`
 
+## Completion discipline (non-negotiable)
+
+Implementers on this project have, in past sessions, reported success without
+actually writing code. To prevent that:
+
+- Your report is **invalid** unless it includes ALL of:
+  1. `git status --short` output showing the files you changed.
+  2. The actual `npm test` output (pass/fail counts) AND `npm run build` output
+     — pasted, not paraphrased.
+  3. For any new/changed UI: a live smoke test (build + serve, or dev server)
+     with real output (page loads, console errors, etc.).
+- If you did not finish, SAY SO. A partial report is useful; a fabricated one
+  is worse than useless and will be caught by QA.
+- Before any smoke test: kill anything on ports 5173 (vite) and 8000 (backend)
+  and start fresh. Never trust already-running servers to be current:
+  ```bash
+  pkill -f "vite" 2>/dev/null; pkill -f "uvicorn main:app" 2>/dev/null; sleep 1
+  cd backend && nohup uv run uvicorn main:app --host 0.0.0.0 --port 8000 &
+  cd frontend && nohup npm run dev &
+  sleep 3
+  ```
+- If a backend contract change is needed for the ticket (e.g. editing
+  `backend/schemas.py`), that's allowed but flag it explicitly in Notes —
+  cross-stack schema edits must be deliberate (spec §8.3 rule 1).
+- `node_modules/`, `dist/`, and `.playwright-cli/` are gitignored — never
+  commit them. Run `git status` before reporting.
+
 ## Output format
 
 ### Completed
-What was done.
+What was done, and which acceptance criteria are met.
 
 ### Files Changed
 - `path/to/file.svelte` — summary
 
+### Evidence
+- `git status --short` output (pasted)
+- `npm test` output (pasted, with pass/fail counts)
+- `npm run build` output (pasted)
+- Smoke-test output for any new/changed UI
+
 ### Notes (if any)
-Anything the caller should know.
+Anything the caller should know — including anything you did NOT finish.