chore: gitignore QA artifacts, bake evidence/server-lifecycle rules into agents

- Untrack .playwright-cli/ and ignore it + *.png; route QA artifacts to /tmp
- be/fe-implementer: require git status + test output + live smoke test in
  every report; never trust a running server, restart fresh; say so if
  unfinished (fixes the false-success-report failure mode from session 1)
- qa: adversarial stance (distrust self-reports, confirm features exist via
  /openapi.json), restart both servers + reset dev DB before testing, write
  expected numbers into scenarios
- Add HANDOFF.md and RETROSPECTIVE.md as session docs

HANDOFF.md

@@ -0,0 +1,90 @@
+# CalCount — Session Handoff (2026-07-26)
+
+Status snapshot for the next worker. Read `SPEC.md` and `IMPLEMENTATION_PLAN.md`
+first; this file only records progress and session-specific notes.
+
+## Where we are in the plan
+
+**Milestone M1 (Manual calorie tracker) is COMPLETE.** Tickets 001–005 all
+implemented, QA-verified, and committed. The app is usable end-to-end for
+manual food entry and daily logging.
+
+| Ticket | Status | Commit |
+|--------|--------|--------|
+| 001 Foods CRUD + soft-delete | ✅ done, QA passed | `3f2c765` |
+| 002 Targets CRUD (single-active invariant) | ✅ done, QA passed | `601c0d4` |
+| 003 Daily log write path | ✅ done, QA passed | `87d7eca` |
+| 004 Day summary endpoint | ✅ done, QA passed | `5372e8c` |
+| 005 Frontend daily view | ✅ done, QA passed | `b69661c` |
+| 006 OFF + barcode scan/search flows | ⬜ **next** | — |
+| 007 Meals (from-log, unpack, recursion) | ⬜ pending | — |
+| 008 Food library view + restore | ⬜ pending | — |
+
+Test counts at HEAD: backend **104 passed** (`cd backend && uv run pytest`),
+frontend vitest + `npm run build` green.
+
+## What was done this session
+
+- Reviewed codebase/spec/plan; confirmed only scaffold existed.
+- Ran tickets 001–005 through the agentic flow: `be-implementer` /
+  `fe-implementer` build, `qa` verifies independently (curl for backend-only
+  tickets, playwright-cli browser automation for frontend), orchestrator
+  commits between tickets.
+- Backend now has: full foods CRUD with soft-delete + shared query helpers,
+  targets with transactional single-active invariant + historical lookup,
+  daily log CRUD with embedded food payloads, and `/api/log/summary` with all
+  nutrition math consolidated in `services/nutrition.py` (weight vs count
+  scaling; meals intentionally contribute 0 — marked TODO for TICKET-007).
+- Frontend now has: dashboard with progress bar vs target, meal-slot grouping,
+  inline edit/delete, date navigation (UTC-safe `shiftDate` in
+  `lib/format.js`), manual Add Food form, search-and-log flow with live
+  preview, minimal target form, loading/error/empty states, mobile-first
+  layout. All HTTP via `lib/api.js`; shared state in `stores.svelte.js`;
+  Svelte 5 runes only.
+
+## Process lessons (important for the next orchestrator)
+
+1. **Implementer agents can falsely report success without writing code.**
+   This happened twice (TICKET-004 backend, first TICKET-005 frontend attempt).
+   Mitigations that worked:
+   - Every implementer task must require `git status --short` evidence and a
+     live smoke test (curl the endpoint / build + serve) in its report.
+   - QA must be explicitly told not to trust the implementer's report and to
+     verify the feature exists (e.g. check `/openapi.json` routes) before
+     testing.
+2. QA (playwright) genuinely catches real bugs — it found broken date-nav
+   buttons and a stale-summary bug in TICKET-005; both were fixed and
+   re-verified before commit.
+3. Backend servers go stale between tickets (old uvicorn missing new routes).
+   QA handles restarts, but expect it.
+
+## Where to pick up: TICKET-006 (Milestone M2)
+
+OFF normalization + barcode scan & search flows. Depends on 005 (done).
+Read the TICKET-006 section of `IMPLEMENTATION_PLAN.md` — key points:
+
+- Backend: OFF → foods normalization in exactly one module (kcal/kJ mapping,
+  User-Agent, timeouts); `GET /api/off/product/{barcode}`, `GET /api/off/search`,
+  `POST /api/off/refresh/{food_id}`; restore-on-rescan rule (§3.1); implement
+  `GET /api/foods/recent`; httpx mocked at the boundary in tests.
+- Frontend: `BarcodeScanner.svelte` + `lib/scanner.js` (native
+  `BarcodeDetector` with lazy zxing-wasm fallback, ~3–5 fps decode loop,
+  camera teardown on destroy); scan flow per §4.1 with manual barcode
+  fallback; OFF fallback in search per §4.2; recent foods surfaced in UI.
+- **Camera testing caveat (from the user):** a webcam exists but real scanner
+  verification (esp. the §8.4 phone checklist — Android Chrome, iOS Safari,
+  EAN-13/UPC-A) needs the user manually over Caddy HTTPS. Don't block the
+  ticket on camera QA: verify the manual-barcode fallback and OFF search
+  flows via playwright, and mark the phone checklist as pending user testing.
+
+## Loose ends / chores
+
+- `.playwright-cli/` artifacts are polluting the repo (some were even tracked
+  in git before this session). Recommend: `git rm -r --cached .playwright-cli`,
+  add it (and `*.png` QA screenshots) to `.gitignore`, commit.
+- `README.md` has an uncommitted user edit ("Agentic dev" section) — left
+  untouched deliberately; commit or discard at the user's discretion.
+- Dev DB (`backend/calcount.db`) contains QA test data ("QA Porridge", a
+  2000 kcal target). Reset by stopping uvicorn, deleting the file, restarting
+  (migrations recreate the schema on startup).
+- Leftover background processes may be running (uvicorn :8000, vite :5173).