diff --git a/.agents/skills/backend-agent/SKILL.md b/.agents/skills/backend-agent/SKILL.md
new file mode 100644
index 0000000..75c4c2f
--- /dev/null
+++ b/.agents/skills/backend-agent/SKILL.md
@@ -0,0 +1,113 @@
+---
+name: backend-agent
+description: Backend specialist for APIs, databases, authentication using FastAPI with clean architecture (Repository/Service/Router pattern). Use for API, endpoint, REST, database, server, migration, and auth work.
+---
+
+# Backend Agent - API & Server Specialist
+
+## When to use
+- Building REST APIs or GraphQL endpoints
+- Database design and migrations
+- Authentication and authorization
+- Server-side business logic
+- Background jobs and queues
+
+## When NOT to use
+- Frontend UI -> use Frontend Agent
+- Mobile-specific code -> use Mobile Agent
+
+## Core Rules
+
+1. **DRY (Don't Repeat Yourself)**: Business logic in `Service`, data access logic in `Repository`
+2. **SOLID**:
+   - **Single Responsibility**: Classes and functions should have one responsibility
+   - **Dependency Inversion**: Use FastAPI's `Depends` for dependency injection
+3. **KISS**: Keep it simple and clear
+
+## Architecture Pattern
+
+```
+Router (HTTP) → Service (Business Logic) → Repository (Data Access) → Models
+```
+
+### Repository Layer
+- **File**: `src/[domain]/repository.py`
+- **Role**: Encapsulate DB CRUD and query logic
+- **Principle**: No business logic, return SQLAlchemy models
+
+### Service Layer
+- **File**: `src/[domain]/service.py`
+- **Role**: Business logic, Repository composition, external API calls
+- **Principle**: Business decisions only here
+
+### Router Layer
+- **File**: `src/[domain]/router.py`
+- **Role**: Receive HTTP requests, input validation, call Service, return response
+- **Principle**: No business logic, inject Service via DI
+
+## Core Rules
+
+1. **Clean architecture**: router → service → repository → models
+2. **No business logic in route handlers**
+3. **All inputs validated with Pydantic**
+4. **Parameterized queries only** (never string interpolation)
+5. **JWT + bcrypt for auth**; rate limit auth endpoints
+6. **Async/await consistently**; type hints on all signatures
+7. **Custom exceptions** via `src/lib/exceptions.py` (not raw HTTPException)
+8. **Explicit ORM loading strategy**: do not rely on default relation loading when query shape matters
+9. **Explicit transaction boundaries**: group one business operation into one request/service-scoped unit of work
+10. **Safe ORM lifecycle**: do not share mutable ORM session/entity manager/client objects across concurrent work unless the ORM explicitly supports it
+
+## Dependency Injection
+
+```python
+# src/recipes/routers/dependencies.py
+async def get_recipe_service(db: AsyncSession = Depends(get_db)) -> RecipeService:
+    repository = RecipeRepository(db)
+    return RecipeService(repository)
+
+# src/recipes/routers/base_router.py
+@router.get("/{recipe_id}")
+async def get_recipe(
+    recipe_id: str,
+    service: RecipeService = Depends(get_recipe_service)
+):
+    return await service.get_recipe(recipe_id)
+```
+
+## Code Quality
+
+- **Python 3.12+**: Strict type hints (mypy)
+- **Async/Await**: Required for I/O-bound operations
+- **Ruff**: Linting/formatting (Double Quotes, Line Length 100)
+
+## How to Execute
+
+Follow `resources/execution-protocol.md` step by step.
+See `resources/examples.md` for input/output examples.
+Use `resources/orm-reference.md` when the task involves ORM query performance, relationship loading, transactions, session/client lifecycle, or N+1 analysis.
+Before submitting, run `resources/checklist.md`.
+
+## Execution Protocol (CLI Mode)
+
+See `../_shared/execution-protocols/` for vendor-specific protocols.
+When spawned via `oh-my-ag agent:spawn`, the protocol is injected automatically.
+
+## References
+
+- Execution steps: `resources/execution-protocol.md`
+- Code examples: `resources/examples.md`
+- Code snippets: `resources/snippets.md`
+- Checklist: `resources/checklist.md`
+- ORM reference: `resources/orm-reference.md`
+- Error recovery: `resources/error-playbook.md`
+- Tech stack: `resources/tech-stack.md`
+- API template: `resources/api-template.py`
+- Context loading: `../_shared/context-loading.md`
+- Reasoning templates: `../_shared/reasoning-templates.md`
+- Clarification: `../_shared/clarification-protocol.md`
+- Context budget: `../_shared/context-budget.md`
+- Lessons learned: `../_shared/lessons-learned.md`
+
+> [!IMPORTANT]
+> When adding new modules, always include `__init__.py` to maintain package structure
diff --git a/.agents/skills/backend-agent/resources/api-template.py b/.agents/skills/backend-agent/resources/api-template.py
new file mode 100644
index 0000000..47847ea
--- /dev/null
+++ b/.agents/skills/backend-agent/resources/api-template.py
@@ -0,0 +1,326 @@
+"""
+API Endpoint Template for Backend Agent
+
+This template demonstrates best practices for FastAPI endpoints.
+"""
+
+from fastapi import APIRouter, Depends, HTTPException, status, Query
+from sqlalchemy.orm import Session
+from typing import Annotated, List
+from uuid import UUID
+
+from app.database import get_db
+from app.auth import get_current_user
+from app.models import User, Resource
+from app.schemas import ResourceCreate, ResourceUpdate, ResourceResponse
+from app.services import ResourceService
+
+# Type aliases for cleaner code
+DatabaseDep = Annotated[Session, Depends(get_db)]
+UserDep = Annotated[User, Depends(get_current_user)]
+
+# Router setup
+router = APIRouter(
+    prefix="/api/resources",
+    tags=["resources"],
+    responses={404: {"description": "Not found"}},
+)
+
+
+# List endpoint with pagination and filtering
+@router.get(
+    "/",
+    response_model=List[ResourceResponse],
+    summary="List resources",
+    description="Retrieve a paginated list of resources with optional filtering"
+)
+async def list_resources(
+    db: DatabaseDep,
+    current_user: UserDep,
+    skip: int = Query(0, ge=0, description="Number of records to skip"),
+    limit: int = Query(100, ge=1, le=1000, description="Max records to return"),
+    search: str | None = Query(None, description="Search query"),
+    status: str | None = Query(None, description="Filter by status"),
+):
+    """
+    List resources with pagination.
+
+    - **skip**: Offset for pagination
+    - **limit**: Maximum number of records
+    - **search**: Optional search term
+    - **status**: Optional status filter
+    """
+    service = ResourceService(db)
+    resources = service.list_resources(
+        user_id=current_user.id,
+        skip=skip,
+        limit=limit,
+        search=search,
+        status=status,
+    )
+    return resources
+
+
+# Get single resource
+@router.get(
+    "/{resource_id}",
+    response_model=ResourceResponse,
+    summary="Get resource",
+    responses={
+        200: {"description": "Resource found"},
+        404: {"description": "Resource not found"},
+        403: {"description": "Access denied"}
+    }
+)
+async def get_resource(
+    resource_id: UUID,
+    db: DatabaseDep,
+    current_user: UserDep,
+):
+    """
+    Get a specific resource by ID.
+
+    Raises:
+        404: Resource not found
+        403: User doesn't own this resource
+    """
+    service = ResourceService(db)
+    resource = service.get_resource(resource_id)
+
+    if not resource:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=f"Resource {resource_id} not found"
+        )
+
+    # Authorization check
+    if resource.user_id != current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Access denied"
+        )
+
+    return resource
+
+
+# Create resource
+@router.post(
+    "/",
+    response_model=ResourceResponse,
+    status_code=status.HTTP_201_CREATED,
+    summary="Create resource",
+)
+async def create_resource(
+    resource_data: ResourceCreate,
+    db: DatabaseDep,
+    current_user: UserDep,
+):
+    """
+    Create a new resource.
+
+    - **name**: Resource name (required)
+    - **description**: Optional description
+    - **status**: Initial status (default: active)
+    """
+    service = ResourceService(db)
+
+    try:
+        resource = service.create_resource(
+            user_id=current_user.id,
+            data=resource_data
+        )
+        return resource
+    except ValueError as e:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=str(e)
+        )
+
+
+# Update resource
+@router.patch(
+    "/{resource_id}",
+    response_model=ResourceResponse,
+    summary="Update resource",
+)
+async def update_resource(
+    resource_id: UUID,
+    resource_data: ResourceUpdate,
+    db: DatabaseDep,
+    current_user: UserDep,
+):
+    """
+    Update an existing resource (partial update).
+
+    Only provided fields will be updated.
+    """
+    service = ResourceService(db)
+    resource = service.get_resource(resource_id)
+
+    if not resource:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=f"Resource {resource_id} not found"
+        )
+
+    if resource.user_id != current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Access denied"
+        )
+
+    try:
+        updated_resource = service.update_resource(resource, resource_data)
+        return updated_resource
+    except ValueError as e:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=str(e)
+        )
+
+
+# Delete resource
+@router.delete(
+    "/{resource_id}",
+    status_code=status.HTTP_204_NO_CONTENT,
+    summary="Delete resource",
+)
+async def delete_resource(
+    resource_id: UUID,
+    db: DatabaseDep,
+    current_user: UserDep,
+    hard: bool = Query(False, description="Perform hard delete instead of soft delete"),
+):
+    """
+    Delete a resource.
+
+    - **hard=false**: Soft delete (default) - sets deleted_at timestamp
+    - **hard=true**: Hard delete - permanently removes from database
+    """
+    service = ResourceService(db)
+    resource = service.get_resource(resource_id)
+
+    if not resource:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=f"Resource {resource_id} not found"
+        )
+
+    if resource.user_id != current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Access denied"
+        )
+
+    service.delete_resource(resource, hard=hard)
+    # 204 No Content - no response body
+
+
+# Bulk operations example
+@router.post(
+    "/bulk",
+    response_model=List[ResourceResponse],
+    status_code=status.HTTP_201_CREATED,
+    summary="Bulk create resources",
+)
+async def bulk_create_resources(
+    resources_data: List[ResourceCreate],
+    db: DatabaseDep,
+    current_user: UserDep,
+):
+    """
+    Create multiple resources in one request.
+
+    Useful for batch imports.
+    """
+    if len(resources_data) > 100:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Maximum 100 resources per bulk operation"
+        )
+
+    service = ResourceService(db)
+    created_resources = []
+
+    try:
+        for data in resources_data:
+            resource = service.create_resource(
+                user_id=current_user.id,
+                data=data
+            )
+            created_resources.append(resource)
+
+        return created_resources
+    except ValueError as e:
+        db.rollback()  # Rollback on error
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=str(e)
+        )
+
+
+# Service class template (separate file: app/services/resource_service.py)
+"""
+from sqlalchemy.orm import Session
+from app.models import Resource
+from app.schemas import ResourceCreate, ResourceUpdate
+from datetime import datetime
+from uuid import UUID
+
+class ResourceService:
+    def __init__(self, db: Session):
+        self.db = db
+
+    def list_resources(
+        self,
+        user_id: UUID,
+        skip: int = 0,
+        limit: int = 100,
+        search: str | None = None,
+        status: str | None = None,
+    ):
+        query = self.db.query(Resource).filter(
+            Resource.user_id == user_id,
+            Resource.deleted_at.is_(None)
+        )
+
+        if search:
+            query = query.filter(Resource.name.ilike(f"%{search}%"))
+
+        if status:
+            query = query.filter(Resource.status == status)
+
+        return query.offset(skip).limit(limit).all()
+
+    def get_resource(self, resource_id: UUID) -> Resource | None:
+        return self.db.query(Resource).filter(
+            Resource.id == resource_id,
+            Resource.deleted_at.is_(None)
+        ).first()
+
+    def create_resource(self, user_id: UUID, data: ResourceCreate) -> Resource:
+        resource = Resource(
+            **data.model_dump(),
+            user_id=user_id
+        )
+        self.db.add(resource)
+        self.db.commit()
+        self.db.refresh(resource)
+        return resource
+
+    def update_resource(self, resource: Resource, data: ResourceUpdate) -> Resource:
+        for field, value in data.model_dump(exclude_unset=True).items():
+            setattr(resource, field, value)
+
+        self.db.commit()
+        self.db.refresh(resource)
+        return resource
+
+    def delete_resource(self, resource: Resource, hard: bool = False):
+        if hard:
+            self.db.delete(resource)
+        else:
+            resource.deleted_at = datetime.utcnow()
+
+        self.db.commit()
+"""
diff --git a/.agents/skills/backend-agent/resources/checklist.md b/.agents/skills/backend-agent/resources/checklist.md
new file mode 100644
index 0000000..b1b7575
--- /dev/null
+++ b/.agents/skills/backend-agent/resources/checklist.md
@@ -0,0 +1,39 @@
+# Backend Agent - Self-Verification Checklist
+
+Run through every item before submitting your work.
+
+## API Design
+- [ ] RESTful conventions followed (proper HTTP methods, status codes)
+- [ ] OpenAPI documentation complete (all endpoints documented)
+- [ ] Request/response schemas defined with Pydantic
+- [ ] Pagination for list endpoints returning > 20 items
+- [ ] Consistent error response format
+
+## Database
+- [ ] Migrations created (Alembic) and tested
+- [ ] Indexes on foreign keys and frequently queried columns
+- [ ] No N+1 queries; relation loading strategy chosen explicitly for the ORM in use
+- [ ] No over-fetching; selected only required fields/columns/attributes
+- [ ] Transactions used for multi-step operations with explicit unit-of-work boundaries
+- [ ] ORM session/client/entity-manager lifecycle matches the framework's concurrency model
+- [ ] Query risks reviewed: missing indexes, full scans, repeated identical queries, join row multiplication
+
+## Security
+- [ ] JWT authentication on protected endpoints
+- [ ] Password hashing with bcrypt (cost 10-12)
+- [ ] Rate limiting on auth endpoints
+- [ ] Input validation with Pydantic (no raw user input in queries)
+- [ ] SQL injection protected (ORM or parameterized queries)
+- [ ] No secrets in code or logs
+
+## Testing
+- [ ] Unit tests for service layer logic
+- [ ] Integration tests for all endpoints (happy + error paths)
+- [ ] Auth scenarios tested (missing token, expired, wrong role)
+- [ ] Test coverage > 80%
+
+## Code Quality
+- [ ] Clean architecture layers: router -> service -> repository
+- [ ] No business logic in route handlers
+- [ ] Async/await used consistently
+- [ ] Type hints on all function signatures
diff --git a/.agents/skills/backend-agent/resources/error-playbook.md b/.agents/skills/backend-agent/resources/error-playbook.md
new file mode 100644
index 0000000..6537ddc
--- /dev/null
+++ b/.agents/skills/backend-agent/resources/error-playbook.md
@@ -0,0 +1,98 @@
+# Backend Agent - Error Recovery Playbook
+
+When you encounter a failure, find the matching scenario and follow the recovery steps.
+Do NOT stop or ask for help until you have exhausted the playbook.
+
+---
+
+## Import / Module Not Found
+
+**Symptoms**: `ModuleNotFoundError`, `ImportError`, `No module named X`
+
+1. Check the import path — typo? wrong package name?
+2. Verify the dependency exists in `pyproject.toml` or `requirements.txt`
+3. If missing: note it in your result as "requires `pip install X`" — do NOT install yourself
+4. If it's a local module: check the directory structure with `get_symbols_overview`
+5. If the path changed: use `search_for_pattern("class ClassName")` to find the new location
+
+---
+
+## Test Failure
+
+**Symptoms**: `pytest` returns FAILED, assertion errors
+
+1. Read the full error output — which test, which assertion, expected vs actual
+2. `find_symbol("test_function_name")` to read the test code
+3. Determine: is the test wrong or is the implementation wrong?
+   - Test expects old behavior → update test
+   - Implementation has a bug → fix implementation
+4. Re-run the specific test: `pytest path/to/test.py::test_name -v`
+5. After fix, run full test suite to check for regressions
+6. **After 3 failures**: Try a different approach. Record current attempt in progress and implement alternative
+
+---
+
+## Database Migration Error
+
+**Symptoms**: `alembic upgrade head` fails, `IntegrityError`, duplicate column
+
+1. Read the error — is it a conflict with existing migration?
+2. Check current DB state: `alembic current`
+3. If migration conflicts: `alembic downgrade -1` then fix migration script
+4. If schema mismatch: compare model with actual DB schema
+5. **NEVER do this**: `alembic stamp head` (risk of data loss)
+
+---
+
+## Authentication / JWT Error
+
+**Symptoms**: 401/403 responses, `InvalidTokenError`, `ExpiredSignatureError`
+
+1. Check: is the secret key consistent between encode and decode?
+2. Check: is the algorithm specified (`HS256` vs `RS256`)?
+3. Check: is the token being sent in the correct header format? (`Bearer {token}`)
+4. Check: is token expiry set correctly? (access: 15min, refresh: 7day)
+5. Test with a manually created token to isolate the issue
+
+---
+
+## N+1 Query / Slow Response
+
+**Symptoms**: API response > 500ms, many similar SQL queries in logs
+
+1. Enable SQL logging: `echo=True` on engine
+2. Count queries for a single request
+3. If N+1: add `joinedload()` or `selectinload()` to the query
+4. If slow single query: check indexes with `EXPLAIN ANALYZE`
+5. If still slow: consider caching with Redis
+
+---
+
+## Rate Limit / Quota Error (Gemini API)
+
+**Symptoms**: `429`, `RESOURCE_EXHAUSTED`, `rate limit exceeded`
+
+1. **Stop immediately** — do not make additional API calls
+2. Save current work to `progress-{agent-id}.md`
+3. Record Status: `quota_exceeded` in `result-{agent-id}.md`
+4. Specify remaining tasks so orchestrator can retry later
+
+---
+
+## Serena Memory Unavailable
+
+**Symptoms**: `write_memory` / `read_memory` failure, timeout
+
+1. Retry once (may be transient error)
+2. If 2 consecutive failures: fall back to local files
+   - progress → write to `/tmp/progress-{agent-id}.md`
+   - result → write to `/tmp/result-{agent-id}.md`
+3. Add `memory_fallback: true` flag to result
+
+---
+
+## General Principles
+
+- **After 3 failures**: If same approach fails 3 times, must try a different method
+- **Blocked**: If no progress after 5 turns, save current state and record `Status: blocked` in result
+- **Out of scope**: If you find issues in another agent's domain, only record in result — do not modify directly
diff --git a/.agents/skills/backend-agent/resources/examples.md b/.agents/skills/backend-agent/resources/examples.md
new file mode 100644
index 0000000..61d6ca4
--- /dev/null
+++ b/.agents/skills/backend-agent/resources/examples.md
@@ -0,0 +1,85 @@
+# Backend Agent - Examples
+
+## Example 1: CRUD API Endpoint
+
+**Input**: "Create a TODO CRUD API with user ownership"
+
+**Output**:
+```
+## Task: TODO CRUD API
+
+### Endpoints Implemented
+- POST /api/todos (create)
+- GET /api/todos (list, user-scoped)
+- GET /api/todos/{id} (detail)
+- PATCH /api/todos/{id} (update)
+- DELETE /api/todos/{id} (delete)
+
+### Database Schema
+- todos table: id (UUID), title (VARCHAR), completed (BOOL), user_id (FK), created_at
+- Index on user_id
+
+### Security
+- [x] All endpoints require JWT auth
+- [x] User can only access own todos (user_id filter)
+- [x] Input validated with Pydantic
+
+### Files Created
+- app/models/todo.py
+- app/schemas/todo.py
+- app/services/todo_service.py
+- app/api/todos.py
+- tests/test_todos.py
+- alembic/versions/xxx_add_todos.py
+```
+
+## Example 2: Authentication System
+
+**Input**: "Add JWT authentication with register and login"
+
+**Output**:
+```
+## Task: JWT Authentication
+
+### Endpoints Implemented
+- POST /api/auth/register (email + password)
+- POST /api/auth/login (returns access + refresh tokens)
+- POST /api/auth/refresh (refresh token rotation)
+
+### Security
+- [x] Password hashed with bcrypt (cost 12)
+- [x] Access token: 15min expiry
+- [x] Refresh token: 7 day expiry, single-use rotation
+- [x] Rate limiting: 5 attempts/min on login
+- [x] Email validation with Pydantic EmailStr
+
+### Files Created
+- app/models/user.py
+- app/schemas/auth.py
+- app/services/auth_service.py
+- app/api/auth.py
+- app/core/security.py (JWT helpers, password hashing)
+- tests/test_auth.py
+```
+
+## Example 3: Fixing N+1 Query
+
+**Input**: "The /api/posts endpoint is slow, taking 2s for 50 posts"
+
+**Output**:
+```
+## Task: Fix N+1 Query in Posts API
+
+### Root Cause
+Each post triggers a separate query for its author (N+1 problem).
+
+### Fix
+Added joinedload(Post.author) to the query.
+
+### Before: 51 queries (1 + 50)
+### After: 1 query with JOIN
+
+### Files Modified
+- app/api/posts.py (added eager loading)
+- tests/test_posts.py (added performance assertion)
+```
diff --git a/.agents/skills/backend-agent/resources/execution-protocol.md b/.agents/skills/backend-agent/resources/execution-protocol.md
new file mode 100644
index 0000000..ea43bad
--- /dev/null
+++ b/.agents/skills/backend-agent/resources/execution-protocol.md
@@ -0,0 +1,47 @@
+# Backend Agent - Execution Protocol
+
+## Step 0: Prepare
+1. **Assess difficulty** — see `../_shared/difficulty-guide.md`
+   - **Simple**: Skip to Step 3 | **Medium**: All 4 steps | **Complex**: All steps + checkpoints
+2. **Check lessons** — read your domain section in `../_shared/lessons-learned.md`
+3. **Clarify requirements** — follow `../_shared/clarification-protocol.md`
+   - Check **Uncertainty Triggers**: business logic, security/auth, existing code conflicts?
+   - Determine level: LOW → proceed | MEDIUM → present options | HIGH → ask immediately
+4. **Budget context** — follow `../_shared/context-budget.md` (read symbols, not whole files)
+
+**⚠️ Intelligent Escalation**: When uncertain, escalate early. Don't blindly proceed.
+
+Follow these steps in order (adjust depth by difficulty).
+
+## Step 1: Analyze
+- Read the task requirements carefully
+- Identify which endpoints, models, and services are needed
+- Check existing code with Serena: `get_symbols_overview("app/api")`, `find_symbol("existing_function")`
+- If the task is ORM-heavy, load `resources/orm-reference.md` before deciding on loading strategy, transaction scope, or client/session lifecycle
+- List assumptions; ask if unclear
+
+## Step 2: Plan
+- Decide on file structure: models, schemas, routes, services
+- Define API contracts (method, path, request/response types)
+- Plan database schema changes (tables, columns, indexes, migrations)
+- Plan relation loading strategy, transaction boundary, and ORM lifecycle constraints explicitly
+- Identify security requirements (auth, validation, rate limiting)
+
+## Step 3: Implement
+- Create/modify files in this order:
+  1. Database models + migrations
+  2. Pydantic schemas (request/response)
+  3. Service layer (business logic)
+  4. API routes (thin, delegate to services)
+  5. Tests (unit + integration)
+- Use `resources/api-template.py` as reference
+- Follow clean architecture: router -> service -> repository -> models
+
+## Step 4: Verify
+- Run `resources/checklist.md` items
+- Run `../_shared/common-checklist.md` items
+- Ensure all tests pass
+- Confirm OpenAPI docs are complete
+
+## On Error
+See `resources/error-playbook.md` for recovery steps.
diff --git a/.agents/skills/backend-agent/resources/orm-reference.md b/.agents/skills/backend-agent/resources/orm-reference.md
new file mode 100644
index 0000000..58b8d03
--- /dev/null
+++ b/.agents/skills/backend-agent/resources/orm-reference.md
@@ -0,0 +1,78 @@
+# Backend Agent - ORM Reference
+
+Use this guide when the task involves ORM query design, relation loading, transaction scoping, or session/client lifecycle decisions.
+
+This document is intentionally synthesized from official ORM docs. The purpose is not to mirror each vendor page, but to extract the common operating rules that keep backend work correct and performant.
+
+## ORM Rules
+
+### 1. Relation loading must be chosen per use case
+
+Backend Agent should therefore:
+- choose loading strategy per endpoint or service method
+- compare join-based eager loading, batched/select-in loading, and separate follow-up queries
+- treat accidental lazy loads in loops as a performance bug
+
+What this rule is derived from:
+- Prisma documents N+1 mitigation through batched access patterns and join-based relation loading
+- SQLAlchemy documents `joinedload`, `selectinload`, `lazyload`, and `raiseload` as explicit strategies
+- TypeORM documents join-based loading and the lazy/eager trade-off
+- Sequelize documents `include` as join-based eager loading and `separate: true` for `hasMany`
+- Hibernate documents that select-based fetching is vulnerable to N+1
+
+### 2. Transaction boundaries must follow business operations
+
+Backend Agent should therefore:
+- open one explicit transaction for one business operation
+- keep read-modify-write flows inside the same transaction boundary
+- avoid per-statement auto-commit designs
+- never hold a database transaction open across user think time
+
+What this rule is derived from:
+- Hibernate explicitly calls session-per-operation and auto-commit-per-statement anti-patterns
+- Sequelize promotes managed transactions around a callback-shaped unit of work
+- SQLAlchemy models the session as transaction-oriented state
+
+### 3. ORM lifecycle objects are not generic shared singletons
+
+Backend Agent should therefore:
+- reuse factory/client objects only when the ORM recommends reuse
+- keep transaction-scoped mutable objects request-scoped or task-scoped
+- never share stateful unit-of-work objects across concurrent tasks unless the vendor explicitly permits it
+
+Operational reading:
+- Prisma: reuse one `PrismaClient` in long-running apps; do not create a new client per query; do not disconnect after every request
+- SQLAlchemy: `Session` and `AsyncSession` are mutable, transaction-scoped, and the documented model is session-per-thread / async-session-per-task
+- Hibernate: prefer session-per-request over session-per-operation
+
+### 4. Field projection is mandatory unless full entity hydration is required
+
+Backend Agent should therefore:
+- fetch only required columns, attributes, or nested fields
+- prefer projections, DTO shaping, or raw results when domain objects are not needed
+- treat over-fetching as a query design flaw, not a minor optimization item
+
+What this rule is derived from:
+- Prisma calls out over-fetching directly and supports nested `select`
+- TypeORM recommends `select` and `getRawMany()`
+- Sequelize documents `attributes` and `{ raw: true }`
+
+### 5. Mapping defaults must never be trusted blindly
+
+Lazy and eager defaults are convenience features, not query plans. Multiple vendors warn that both directions can fail differently:
+- lazy defaults can explode into N+1
+- eager defaults can create oversized joins, duplicate parent rows, or unnecessary payloads
+
+Backend Agent should therefore:
+- inspect relation defaults before changing repository or endpoint behavior
+- override defaults at query time when access shape differs from mapping defaults
+- prefer repository-level query shaping over relying on entity metadata alone
+
+### 6. Query review must include access-path and row-shape checks
+
+Backend Agent should therefore review:
+- missing indexes on filters, joins, and foreign keys
+- full table scans
+- repeated identical queries that should be cached or batched
+- row multiplication from `hasMany` / collection eager joins
+- memory cost of hydrating full entities when raw results or projections are enough
diff --git a/.agents/skills/backend-agent/resources/snippets.md b/.agents/skills/backend-agent/resources/snippets.md
new file mode 100644
index 0000000..218bf2a
--- /dev/null
+++ b/.agents/skills/backend-agent/resources/snippets.md
@@ -0,0 +1,197 @@
+# Backend Agent - Code Snippets
+
+Copy-paste ready patterns. Use these as starting points, adapt to the specific task.
+
+---
+
+## FastAPI Route with Auth
+
+```python
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.deps import get_current_user, get_db
+from app.models.user import User
+from app.schemas.resource import ResourceCreate, ResourceResponse
+
+router = APIRouter(prefix="/api/resources", tags=["resources"])
+
+@router.post("/", response_model=ResourceResponse, status_code=status.HTTP_201_CREATED)
+async def create_resource(
+    data: ResourceCreate,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
+    resource = Resource(**data.model_dump(), user_id=current_user.id)
+    db.add(resource)
+    await db.commit()
+    await db.refresh(resource)
+    return resource
+```
+
+---
+
+## Pydantic Schema Pair
+
+```python
+from datetime import datetime
+from uuid import UUID
+from pydantic import BaseModel, Field
+
+class ResourceCreate(BaseModel):
+    title: str = Field(..., min_length=1, max_length=200)
+    description: str | None = None
+
+class ResourceResponse(BaseModel):
+    id: UUID
+    title: str
+    description: str | None
+    user_id: UUID
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+```
+
+---
+
+## SQLAlchemy Model
+
+```python
+import uuid
+from datetime import datetime
+from sqlalchemy import ForeignKey, String, Text
+from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from app.core.database import Base
+
+class Resource(Base):
+    __tablename__ = "resources"
+
+    id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
+    title: Mapped[str] = mapped_column(String(200), nullable=False)
+    description: Mapped[str | None] = mapped_column(Text, nullable=True)
+    user_id: Mapped[uuid.UUID] = mapped_column(ForeignKey("users.id"), nullable=False, index=True)
+    created_at: Mapped[datetime] = mapped_column(default=datetime.utcnow)
+
+    user: Mapped["User"] = relationship(back_populates="resources")
+```
+
+---
+
+## JWT Auth Dependency
+
+```python
+from fastapi import Depends, HTTPException, status
+from fastapi.security import OAuth2PasswordBearer
+from jose import JWTError, jwt
+
+from app.core.config import settings
+
+oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/auth/login")
+
+async def get_current_user(
+    token: str = Depends(oauth2_scheme),
+    db: AsyncSession = Depends(get_db),
+) -> User:
+    try:
+        payload = jwt.decode(token, settings.SECRET_KEY, algorithms=["HS256"])
+        user_id = payload.get("sub")
+        if user_id is None:
+            raise HTTPException(status_code=401, detail="Invalid token")
+    except JWTError:
+        raise HTTPException(status_code=401, detail="Invalid token")
+
+    user = await db.get(User, user_id)
+    if user is None:
+        raise HTTPException(status_code=401, detail="User not found")
+    return user
+```
+
+---
+
+## Password Hashing
+
+```python
+from passlib.context import CryptContext
+
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+def hash_password(password: str) -> str:
+    return pwd_context.hash(password)
+
+def verify_password(plain: str, hashed: str) -> bool:
+    return pwd_context.verify(plain, hashed)
+```
+
+---
+
+## Paginated Query
+
+```python
+from sqlalchemy import select, func
+
+async def paginate(
+    db: AsyncSession,
+    query,
+    page: int = 1,
+    size: int = 20,
+):
+    total = await db.scalar(select(func.count()).select_from(query.subquery()))
+    items = await db.scalars(query.offset((page - 1) * size).limit(size))
+    return {
+        "items": list(items),
+        "total": total,
+        "page": page,
+        "size": size,
+    }
+```
+
+---
+
+## Alembic Migration
+
+```python
+"""add resources table
+
+Revision ID: xxxx
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID
+
+def upgrade() -> None:
+    op.create_table(
+        "resources",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True),
+        sa.Column("title", sa.String(200), nullable=False),
+        sa.Column("description", sa.Text, nullable=True),
+        sa.Column("user_id", UUID(as_uuid=True), sa.ForeignKey("users.id"), nullable=False),
+        sa.Column("created_at", sa.DateTime, server_default=sa.func.now()),
+    )
+    op.create_index("ix_resources_user_id", "resources", ["user_id"])
+
+def downgrade() -> None:
+    op.drop_table("resources")
+```
+
+---
+
+## Test with httpx
+
+```python
+import pytest
+from httpx import AsyncClient
+
+@pytest.mark.asyncio
+async def test_create_resource(client: AsyncClient, auth_headers: dict):
+    response = await client.post(
+        "/api/resources/",
+        json={"title": "Test", "description": "Test desc"},
+        headers=auth_headers,
+    )
+    assert response.status_code == 201
+    data = response.json()
+    assert data["title"] == "Test"
+    assert "id" in data
+```
diff --git a/.agents/skills/backend-agent/resources/tech-stack.md b/.agents/skills/backend-agent/resources/tech-stack.md
new file mode 100644
index 0000000..448b53e
--- /dev/null
+++ b/.agents/skills/backend-agent/resources/tech-stack.md
@@ -0,0 +1,43 @@
+# Backend Agent - Tech Stack Reference
+
+## Python (Preferred)
+- **Framework**: FastAPI 0.110+
+- **ORM**: SQLAlchemy 2.0 (async)
+- **Validation**: Pydantic v2
+- **Database**: PostgreSQL 16+, Redis 7+
+- **Auth**: python-jose (JWT), passlib (bcrypt)
+- **Testing**: pytest, httpx (async test client)
+- **Migrations**: Alembic
+
+## Node.js (Alternative)
+- **Framework**: Express.js, NestJS, Hono
+- **ORM**: Prisma, Drizzle
+- **Validation**: Zod
+- **Auth**: jsonwebtoken, bcrypt
+- **Testing**: Jest, Supertest
+
+## Architecture
+
+```
+backend/
+  domain/           # Business logic (pure Python, no framework deps)
+  application/      # Use cases, services
+  infrastructure/   # Database, cache, external APIs
+  presentation/     # API endpoints, middleware
+```
+
+## Security Requirements
+- Password hashing: bcrypt (cost factor 10-12)
+- JWT: 15min access tokens, 7 day refresh tokens
+- Rate limiting on auth endpoints
+- Input validation with Pydantic/Zod
+- Parameterized queries (never string interpolation)
+
+## ORM Guidance
+- Cross-ORM operational rules and official vendor references: `resources/orm-reference.md`
+- Primary references covered there: Prisma, SQLAlchemy, TypeORM, Sequelize, Hibernate
+
+## Serena MCP Shortcuts
+- `find_symbol("create_todo")`: Locate existing function
+- `get_symbols_overview("app/api")`: List all endpoints
+- `find_referencing_symbols("User")`: Find all usages of a model
diff --git a/.agents/skills/backend-development/SKILL.md b/.agents/skills/backend-development/SKILL.md
deleted file mode 100644
index 5d0216f..0000000
--- a/.agents/skills/backend-development/SKILL.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-name: backend-development
-description: Comprehensive backend development skill for building scalable backend systems using Python (FastAPI), Postgres, Redis, and more. Includes API design, database optimization, security implementation, and performance tuning.
----
-
-# Backend Development
-
-This skill provides expert guidance for building robust, scalable, and secure backend systems, primarily focusing on the Python/FastAPI ecosystem used in this project.
-
-## Core Capabilities
-
-### 1. API Design & Implementation
-- **RESTful Design**: Resource-oriented URLs, proper HTTP methods, and status codes.
-- **FastAPI Best Practices**: Validation with Pydantic, dependency injection, and async handlers.
-- **Documentation**: Automatic OpenAPI generation, clear descriptions, and examples.
-
-### 2. Database Management
-- **Schema Design**: Normalized relationships, indexing strategies, and migration management (Alembic).
-- **ORM Usage**: SQLAlchemy async session management, repository pattern.
-- **Optimization**: N+1 problem avoidance, query analysis, connection pooling.
-
-### 3. Security
-- **Authentication**: JWT/OAuth2 implementation, password hashing (bcrypt/argon2).
-- **Authorization**: Role-Based Access Control (RBAC), scopes.
-- **Data Protection**: Input sanitization, SQL injection prevention (via ORM), secure headers.
-
-### 4. Performance Tuning
-- **Caching**: Redis implementation for specific endpoints or data.
-- **Async I/O**: Non-blocking database and API calls.
-- **Background Tasks**: Offloading heavy processing (Celery/Cloud Tasks).
-
-## Design Patterns
-
-- **Repository Pattern**: Decouple business logic from data access.
-- **Dependency Injection**: Manage dependencies (DB sessions, config) cleanly.
-- **Service Layer**: Encapsulate complex business rules.
-
-## When to Use
-
-- Designing new API endpoints or microservices.
-- Optimizing slow database queries.
-- Implementing complex business logic.
-- Reviewing backend code for security and performance.
-- Setting up authentication and authorization flows.
diff --git a/.agents/skills/brainstorm/SKILL.md b/.agents/skills/brainstorm/SKILL.md
new file mode 100644
index 0000000..3db6e61
--- /dev/null
+++ b/.agents/skills/brainstorm/SKILL.md
@@ -0,0 +1,55 @@
+---
+name: brainstorm
+description: Design-first ideation that explores user intent, constraints, and approaches before any planning or implementation. Use for brainstorming, ideation, exploring concepts, and evaluating approaches.
+---
+
+# Brainstorm - Design-First Ideation
+
+## When to use
+- Exploring a new feature idea before planning
+- Understanding user intent and constraints before committing to an approach
+- Comparing multiple design approaches with trade-offs
+- When the user says "I have an idea" or "let's design something"
+- Before invoking `/plan` for complex or ambiguous requests
+
+## When NOT to use
+- Requirements are already clear and well-defined -> use pm-agent directly
+- Implementing actual code -> delegate to specialized agents
+- Performing code reviews -> use QA Agent
+- Debugging existing issues -> use debug-agent
+
+## Core Rules
+1. **No implementation or planning before design approval** - brainstorm produces a design document, not code or task plans
+2. **One question at a time** - ask clarifying questions sequentially, not in batches
+3. **Always propose 2-3 approaches** - include a recommended option with trade-off analysis
+4. **Section-by-section design** - present design incrementally with user confirmation at each step
+5. **YAGNI** - do not over-engineer; design only what is needed for the stated goal
+6. **Save design, then transition** - persist the approved design document before handing off to `/plan`
+
+## How to Execute
+Follow the brainstorm workflow step by step:
+1. **Phase 1 - Context**: Explore the existing codebase and understand the project landscape
+2. **Phase 2 - Questions**: Ask clarifying questions one at a time to understand intent and constraints
+3. **Phase 3 - Approaches**: Propose 2-3 approaches with a recommended option and trade-off matrix
+4. **Phase 4 - Design**: Present the detailed design section by section, getting user approval at each step
+5. **Phase 5 - Documentation**: Save the approved design to `docs/plans/` and project memory
+6. **Phase 6 - Transition**: Hand off to `/plan` for task decomposition
+
+## Common Pitfalls
+- **Jumping to solutions**: Asking "how" before fully understanding "what" and "why"
+- **Too many questions at once**: Overwhelming the user with a wall of questions
+- **Single approach bias**: Presenting only one option without alternatives
+- **Over-engineering**: Designing for hypothetical future requirements instead of stated needs
+- **Skipping confirmation**: Moving forward without explicit user approval on design decisions
+
+## Execution Protocol (CLI Mode)
+
+See `../_shared/execution-protocols/` for vendor-specific protocols.
+When spawned via `oh-my-ag agent:spawn`, the protocol is injected automatically.
+
+## References
+- Context loading: `../_shared/context-loading.md`
+- Reasoning templates: `../_shared/reasoning-templates.md`
+- Clarification protocol: `../_shared/clarification-protocol.md`
+- Quality principles: `../_shared/quality-principles.md`
+- Skill routing: `../_shared/skill-routing.md`
diff --git a/.agents/skills/commit/SKILL.md b/.agents/skills/commit/SKILL.md
new file mode 100644
index 0000000..88eb6a9
--- /dev/null
+++ b/.agents/skills/commit/SKILL.md
@@ -0,0 +1,117 @@
+---
+name: commit
+description: Create git commits following Conventional Commits specification with project-specific branch naming rules. Use for commit message generation, changelog, and versioning.
+---
+
+# Commit Skill - Conventional Commits
+
+## When to use
+- When user requests "commit this", "commit", "save changes"
+- When `/commit` command is invoked
+
+## Configuration
+Project-specific settings: `.agents/skills/commit/config/commit-config.yaml`
+
+## Commit Types
+| Type | Description | Branch Prefix |
+|------|-------------|---------------|
+| feat | New feature | feature/ |
+| fix | Bug fix | fix/ |
+| refactor | Code improvement | refactor/ |
+| docs | Documentation changes | docs/ |
+| test | Test additions/modifications | test/ |
+| chore | Build, configuration, etc. | chore/ |
+| style | Code style changes | style/ |
+| perf | Performance improvements | perf/ |
+
+## Commit Format
+```
+<type>(<scope>): <description>
+
+[optional body]
+
+Co-Authored-By: First Fluke <our.first.fluke@gmail.com>
+```
+
+## Workflow
+
+### Step 1: Analyze Changes
+```bash
+git status
+git diff --staged
+git log --oneline -5
+```
+
+### Step 1.5: Split by Feature (if needed)
+If changed files span multiple features/domains, **split commits by feature**.
+
+**Split criteria:**
+- Different scopes (e.g., workflows vs skills vs docs)
+- Different types (e.g., feat vs fix vs docs)
+- Logically independent changes
+
+**Example:**
+```
+# Changed files:
+.agents/workflows/*.md (7 files)     → fix(workflows): ...
+.agents/skills/**/*.md (4 files)     → fix(skills): ...
+USAGE.md, USAGE-ko.md               → docs: ...
+
+# Split into 3 commits
+```
+
+**Do NOT split when:**
+- All changes belong to a single feature
+- Few files changed (5 or fewer)
+- User requested a single commit
+
+### Step 2: Determine Commit Type
+Analyze changes → Select appropriate type:
+- New files added → `feat`
+- Bug fixed → `fix`
+- Refactoring → `refactor`
+- Documentation only → `docs`
+- Tests added → `test`
+- Build/config changes → `chore`
+
+### Step 3: Determine Scope
+Use changed module/component as scope:
+- `feat(auth)`: Authentication related
+- `fix(api)`: API related
+- `refactor(ui)`: UI related
+- No scope is also valid: `chore: update dependencies`
+
+### Step 4: Write Description
+- Under 72 characters
+- Use imperative mood (add, fix, update, remove...)
+- Lowercase first letter
+- No trailing period
+
+### Step 5: Execute Commit
+Show the commit message and proceed immediately without asking for confirmation:
+```
+📝 Committing:
+
+feat(orchestrator): add multi-CLI agent mapping support
+
+- Add user-preferences.yaml for CLI configuration
+- Update spawn-agent.sh to read agent-CLI mapping
+- Update memory schema with CLI field
+
+Co-Authored-By: First Fluke <our.first.fluke@gmail.com>
+```
+
+```bash
+git add <specific-files>
+git commit -m "<message>"
+```
+
+## References
+- Configuration: `config/commit-config.yaml`
+- Guide: `resources/conventional-commits.md`
+
+## Important Notes
+- **NEVER** use `git add -A` or `git add .` without explicit permission
+- **NEVER** commit files that may contain secrets (.env, credentials, etc.)
+- **ALWAYS** use specific file names when staging
+- **ALWAYS** use HEREDOC for multi-line commit messages
diff --git a/.agents/skills/commit/config/commit-config.yaml b/.agents/skills/commit/config/commit-config.yaml
new file mode 100644
index 0000000..1434586
--- /dev/null
+++ b/.agents/skills/commit/config/commit-config.yaml
@@ -0,0 +1,55 @@
+# Commit Configuration
+
+# Enable Conventional Commits
+conventional_commits: true
+
+# Allowed commit types
+types:
+  - feat
+  - fix
+  - refactor
+  - docs
+  - test
+  - chore
+  - style
+  - perf
+
+# Branch prefix rules
+branch_prefixes:
+  feat: "feature/"
+  fix: "fix/"
+  refactor: "refactor/"
+  docs: "docs/"
+  test: "test/"
+  chore: "chore/"
+  hotfix: "hotfix/"
+  style: "style/"
+  perf: "perf/"
+
+# Commit message rules
+message:
+  max_subject_length: 72
+  require_body: false
+  body_wrap_length: 100
+
+# Scope rules
+scope:
+  required: false
+  # Allowed scopes list (empty means all allowed)
+  allowed: []
+
+# Co-Author settings
+co_author:
+  enabled: true
+  name: "First Fluke"
+  email: "our.first.fluke@gmail.com"
+
+# Forbidden file patterns (commit warnings)
+forbidden_patterns:
+  - "*.env"
+  - "*.env.*"
+  - "credentials.json"
+  - "secrets.yaml"
+  - "*.pem"
+  - "*.key"
+  - ".env.local"
diff --git a/.agents/skills/commit/resources/conventional-commits.md b/.agents/skills/commit/resources/conventional-commits.md
new file mode 100644
index 0000000..0644dd9
--- /dev/null
+++ b/.agents/skills/commit/resources/conventional-commits.md
@@ -0,0 +1,166 @@
+# Conventional Commits Guide
+
+## Overview
+
+Conventional Commits applies consistent rules to commit messages to enable:
+- Automated CHANGELOG generation
+- Semantic Versioning automation
+- Improved commit history readability across teams
+
+## Commit Message Structure
+
+```
+<type>[optional scope]: <description>
+
+[optional body]
+
+[optional footer(s)]
+```
+
+## Types
+
+### Primary Types
+
+| Type | Description | SemVer | Example |
+|------|-------------|--------|---------|
+| `feat` | Add new feature | MINOR | `feat: add user authentication` |
+| `fix` | Bug fix | PATCH | `fix: resolve login timeout issue` |
+
+### Secondary Types
+
+| Type | Description | SemVer | Example |
+|------|-------------|--------|---------|
+| `docs` | Documentation changes | - | `docs: update API documentation` |
+| `style` | Code style changes (formatting, semicolons, etc.) | - | `style: fix indentation` |
+| `refactor` | Code improvement without behavior change | - | `refactor: extract helper function` |
+| `perf` | Performance improvements | PATCH | `perf: optimize database queries` |
+| `test` | Add/modify tests | - | `test: add unit tests for auth` |
+| `chore` | Build, config, packages | - | `chore: update dependencies` |
+
+## Scope
+
+Scope indicates the area of changed code:
+
+```
+feat(auth): add OAuth2 support
+fix(api): handle null response
+refactor(ui): simplify button component
+```
+
+### Common Scopes
+- `auth` - Authentication/authorization
+- `api` - API endpoints
+- `ui` - User interface
+- `db` - Database
+- `config` - Configuration
+- `deps` - Dependencies
+
+## Description
+
+- **Imperative mood**: "add", "fix", "update" (NOT "added", "fixed", "updates")
+- **Lowercase first letter**
+- **No trailing period**
+- **72 characters or less**
+
+### Good Examples
+```
+feat(auth): add JWT token refresh mechanism
+fix(api): handle empty response from payment gateway
+refactor(ui): extract common button styles
+```
+
+### Bad Examples
+```
+feat(auth): Added JWT token refresh mechanism.  # past tense, period
+fix: fix bug  # insufficient description
+Update the authentication system to support OAuth2 tokens and refresh mechanism  # too long
+```
+
+## Body
+
+Body is optional but useful for complex changes:
+
+```
+feat(auth): add multi-factor authentication
+
+Implement TOTP-based two-factor authentication:
+- Add QR code generation for authenticator apps
+- Store encrypted TOTP secrets in database
+- Add backup codes for account recovery
+
+Closes #123
+```
+
+## Breaking Changes
+
+Breaking changes marked with `!` or in footer:
+
+```
+feat(api)!: change response format for user endpoint
+
+BREAKING CHANGE: The user endpoint now returns a nested object
+instead of a flat structure. Update client code accordingly.
+```
+
+## Footer
+
+### Issue References
+```
+feat(auth): add password reset flow
+
+Closes #456
+Refs #123, #789
+```
+
+### Co-Authors
+```
+feat(ui): redesign dashboard
+
+Co-Authored-By: Jane Doe <jane@example.com>
+Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
+```
+
+## Branch Naming Convention
+
+| Type | Branch Prefix | Example |
+|------|---------------|---------|
+| feat | `feature/` | `feature/user-auth` |
+| fix | `fix/` | `fix/login-timeout` |
+| refactor | `refactor/` | `refactor/api-cleanup` |
+| docs | `docs/` | `docs/api-guide` |
+| hotfix | `hotfix/` | `hotfix/security-patch` |
+
+## Commit Workflow
+
+1. **Stage specific files** (NOT `git add .`):
+   ```bash
+   git add src/auth/login.ts
+   git add tests/auth/login.test.ts
+   ```
+
+2. **Write commit message**:
+   ```bash
+   git commit -m "$(cat <<'EOF'
+   feat(auth): add login rate limiting
+
+   - Limit failed attempts to 5 per minute
+   - Add exponential backoff for repeated failures
+   - Log suspicious activity
+
+   Closes #234
+
+   Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
+   EOF
+   )"
+   ```
+
+3. **Verify**:
+   ```bash
+   git log -1 --format=full
+   ```
+
+## Resources
+
+- [Conventional Commits Specification](https://www.conventionalcommits.org/)
+- [Semantic Versioning](https://semver.org/)
+- [Angular Commit Guidelines](https://github.com/angular/angular/blob/main/CONTRIBUTING.md#commit)
diff --git a/.agents/skills/debug-agent/SKILL.md b/.agents/skills/debug-agent/SKILL.md
new file mode 100644
index 0000000..cfad270
--- /dev/null
+++ b/.agents/skills/debug-agent/SKILL.md
@@ -0,0 +1,53 @@
+---
+name: debug-agent
+description: Bug diagnosis and fixing specialist - analyzes errors, identifies root causes, provides fixes, and writes regression tests. Use for bug, debug, error, crash, traceback, exception, and regression work.
+---
+
+# Debug Agent - Bug Fixing Specialist
+
+## When to use
+- User reports a bug with error messages
+- Something is broken and needs fixing
+- Performance issues or slowdowns
+- Intermittent failures or race conditions
+- Regression bugs
+
+## When NOT to use
+- Building new features -> use Frontend/Backend/Mobile agents
+- General code review -> use QA Agent
+
+## Core Rules
+1. Reproduce first, then diagnose - never guess at fixes
+2. Identify root cause, not just symptoms
+3. Minimal fix: change only what's necessary
+4. Every fix gets a regression test
+5. Search for similar patterns elsewhere after fixing
+6. Document in `.agents/brain/bugs/`
+
+## How to Execute
+Follow `resources/execution-protocol.md` step by step.
+See `resources/examples.md` for input/output examples.
+Before submitting, run `resources/checklist.md`.
+
+## Serena MCP
+- `find_symbol("functionName")`: Locate the function
+- `find_referencing_symbols("Component")`: Find all usages
+- `search_for_pattern("error pattern")`: Find similar issues
+
+## Execution Protocol (CLI Mode)
+
+See `../_shared/execution-protocols/` for vendor-specific protocols.
+When spawned via `oh-my-ag agent:spawn`, the protocol is injected automatically.
+
+## References
+- Execution steps: `resources/execution-protocol.md`
+- Code examples: `resources/examples.md`
+- Checklist: `resources/checklist.md`
+- Error recovery: `resources/error-playbook.md`
+- Bug report template: `resources/bug-report-template.md`
+- Common patterns: `resources/common-patterns.md`
+- Debugging checklist: `resources/debugging-checklist.md`
+- Context loading: `../_shared/context-loading.md`
+- Reasoning templates: `../_shared/reasoning-templates.md`
+- Context budget: `../_shared/context-budget.md`
+- Lessons learned: `../_shared/lessons-learned.md`
diff --git a/.agents/skills/debug-agent/resources/bug-report-template.md b/.agents/skills/debug-agent/resources/bug-report-template.md
new file mode 100644
index 0000000..ca3112d
--- /dev/null
+++ b/.agents/skills/debug-agent/resources/bug-report-template.md
@@ -0,0 +1,332 @@
+# Bug Report Template
+
+Use this template when documenting bugs in the Knowledge Base.
+
+Save to: `.agents/brain/bugs/bug-YYYYMMDD-[short-description].md`
+
+---
+
+# Bug: [Short Descriptive Title]
+
+**Date Reported**: YYYY-MM-DD
+**Date Fixed**: YYYY-MM-DD (or "In Progress")
+**Reporter**: [User name or issue number]
+**Assignee**: [Agent that fixed it]
+**Severity**: 🔴 CRITICAL | 🟠 HIGH | 🟡 MEDIUM | 🔵 LOW
+**Status**: 🐛 OPEN | 🔧 IN PROGRESS | ✅ FIXED | ⏸️ ON HOLD | ❌ WON'T FIX
+
+---
+
+## 📝 Problem Description
+
+**What happened?**
+[Clear description of the bug from user's perspective]
+
+**What was expected?**
+[What should have happened instead]
+
+**Impact**:
+- Users affected: [All | Specific role | Percentage]
+- Business impact: [Revenue loss | User frustration | Security risk]
+- Workaround available: [Yes/No - describe if yes]
+
+---
+
+## 🔄 Reproduction Steps
+
+1. Navigate to [page/route]
+2. Click on [button/element]
+3. Enter [data] in [field]
+4. Observe [unexpected behavior]
+
+**Frequency**:
+- [ ] Every time (100%)
+- [ ] Intermittent (specify pattern: ___%)
+- [ ] Specific conditions only (describe: ___)
+
+---
+
+## 🖼️ Evidence
+
+**Error Messages**:
+```
+[Exact error text from console/logs]
+```
+
+**Stack Trace**:
+```
+[Full stack trace if available]
+```
+
+**Screenshots**:
+- Before: [description or file path]
+- After: [description or file path]
+- Error state: [description or file path]
+
+**Browser Console**:
+```javascript
+// Relevant console errors
+```
+
+**Network Requests**:
+```
+Request URL: [URL]
+Status Code: [200/404/500/etc]
+Response: [relevant response data]
+```
+
+---
+
+## 🌍 Environment
+
+**Frontend**:
+- Browser: [Chrome 120 | Firefox 121 | Safari 17]
+- OS: [Windows 11 | macOS 14 | iOS 17 | Android 14]
+- Screen size: [Desktop | Tablet | Mobile]
+- Browser extensions: [Any relevant extensions]
+
+**Backend**:
+- Environment: [Development | Staging | Production]
+- Server version: [API version]
+- Database: [PostgreSQL 16.1]
+
+**Mobile** (if applicable):
+- Device: [iPhone 15 | Samsung Galaxy S24]
+- OS Version: [iOS 17.2 | Android 14]
+- App Version: [1.2.3]
+
+---
+
+## 🔍 Investigation
+
+### Initial Analysis
+
+**Hypothesis**:
+[What you think is causing the bug]
+
+**Investigation Steps Taken**:
+1. [What was checked]
+2. [What was ruled out]
+3. [Key findings]
+
+### Root Cause
+
+**Technical Explanation**:
+[Deep dive into why the bug occurs]
+
+**Code Location**:
+- File: `path/to/file.tsx`
+- Line: 145
+- Function: `handleSubmit()`
+
+**Specific Issue**:
+```typescript
+// Problem code
+const user = data.user.profile.name; // Crashes if profile is undefined
+```
+
+**Why it happens**:
+[Explain the conditions that trigger this]
+
+---
+
+## 🔧 Solution
+
+### Fix Applied
+
+**Approach**:
+[High-level description of the fix strategy]
+
+**Code Changes**:
+
+```typescript
+// File: path/to/file.tsx (line 145)
+
+// ❌ BEFORE (buggy code)
+const user = data.user.profile.name;
+
+// ✅ AFTER (fixed code)
+const user = data?.user?.profile?.name ?? 'Unknown';
+```
+
+**Why this works**:
+[Explain the fix]
+
+### Files Modified
+
+- ✏️ `src/components/UserProfile.tsx` - Added null check for profile
+- ✏️ `src/lib/api/users.ts` - Improved error handling
+- ➕ `src/components/UserProfile.test.tsx` - Added regression test
+
+### Migration/Deployment Notes
+
+**Database Changes**: None | [Describe migrations needed]
+**Configuration Changes**: None | [Describe config updates]
+**Breaking Changes**: None | [Describe breaking changes]
+**Rollback Plan**: [How to revert if needed]
+
+---
+
+## ✅ Verification
+
+### Testing Performed
+
+- [x] **Regression test added**
+  - File: `src/components/UserProfile.test.tsx`
+  - Coverage: Null profile, undefined user, missing name
+
+- [x] **Manual testing**
+  - Tested original reproduction steps
+  - Tested edge cases (null, undefined, empty)
+  - Verified fix works in all browsers
+
+- [x] **Related areas checked**
+  - Found similar pattern in `TeamProfile.tsx` - also fixed
+  - Checked all `.profile.` usages - 3 more locations updated
+
+- [x] **Performance impact**: None | [Describe if any]
+
+### Test Results
+
+**Unit Tests**: ✅ 15/15 passing
+**Integration Tests**: ✅ 8/8 passing
+**E2E Tests**: ✅ 3/3 passing
+**Manual QA**: ✅ Verified on Chrome, Firefox, Safari
+
+---
+
+## 📚 Prevention
+
+### How to Avoid Similar Bugs
+
+1. **Always check for null/undefined** before accessing nested properties
+2. **Use optional chaining (`?.`)** for safe property access
+3. **Provide default values** with nullish coalescing (`??`)
+4. **Add TypeScript strict null checks** to catch at compile time
+5. **Write defensive code** - assume data might be missing
+
+### Code Patterns to Follow
+
+```typescript
+// ✅ GOOD: Safe access with fallback
+const name = user?.profile?.name ?? 'Anonymous';
+
+// ✅ GOOD: Explicit null check
+if (user?.profile) {
+  const name = user.profile.name;
+}
+
+// ✅ GOOD: Early return
+if (!user?.profile) {
+  return <div>No profile available</div>;
+}
+
+// ❌ BAD: Unsafe nested access
+const name = user.profile.name; // Crashes if profile undefined
+```
+
+### Recommended Tools
+
+- **TypeScript** with `strictNullChecks: true`
+- **ESLint** rule: `no-unsafe-member-access`
+- **Unit tests** for edge cases (null, undefined, empty)
+
+---
+
+## 🔗 Related
+
+**Similar Bugs**:
+- Bug #123: Similar null check issue in `CommentList`
+- Bug #456: Related data loading pattern
+
+**Dependent Issues**:
+- Issue #789: Need to improve error handling across all API calls
+
+**Documentation**:
+- [Link to architecture decision record]
+- [Link to API documentation]
+
+**External References**:
+- [Stack Overflow link if used]
+- [GitHub issue in library if relevant]
+
+---
+
+## 📊 Metrics
+
+**Time to Fix**: [2 hours | 1 day | 1 week]
+**Lines Changed**: [+15 -5]
+**Files Affected**: [3 files]
+**Tests Added**: [5 new tests]
+
+---
+
+## 💬 Communication
+
+**Notified**:
+- [x] Product Manager - Impact assessment
+- [x] QA Team - Additional testing needed
+- [x] Users affected - Via email/announcement
+- [ ] Other teams - [Specify]
+
+**Changelog Entry**:
+```markdown
+### Fixed
+- Fixed crash when user profile is missing ([#issue-number])
+```
+
+---
+
+## 🎓 Lessons Learned
+
+**What went well**:
+- Quick identification of root cause
+- Proactive fix of similar patterns
+- Comprehensive test coverage
+
+**What could improve**:
+- Should have caught this in code review
+- TypeScript strict mode would have prevented this
+- Need better null check linting rules
+
+**Action Items**:
+- [ ] Enable TypeScript strictNullChecks across project
+- [ ] Add ESLint rule for unsafe member access
+- [ ] Update code review checklist to include null checks
+- [ ] Create coding standards doc for defensive programming
+
+---
+
+## 🏷️ Tags
+
+`frontend` `null-check` `crash` `typescript` `user-profile` `high-priority`
+
+---
+
+**Sign-off**: [Your name/agent name]
+**Reviewed by**: [PM Agent | QA Agent | Frontend Agent]
+**Approved for deploy**: [Yes/No]
+
+---
+
+## Template Notes
+
+**How to use this template**:
+
+1. **Copy this template** when documenting a new bug
+2. **Fill in all sections** - don't skip parts
+3. **Be specific** - future developers need details
+4. **Include code** - show the before/after
+5. **Link related issues** - help connect patterns
+6. **Update status** as work progresses
+7. **Save to Knowledge Base** for future reference
+
+**Sections you can skip**:
+- Screenshots (if text description is clear)
+- Stack trace (if no error thrown)
+- Migration notes (if no DB/config changes)
+
+**Optional sections to add**:
+- Timeline (for long-running bugs)
+- Cost impact (for business-critical bugs)
+- Vendor communication (if third-party bug)
diff --git a/.agents/skills/debug-agent/resources/checklist.md b/.agents/skills/debug-agent/resources/checklist.md
new file mode 100644
index 0000000..fd32b3a
--- /dev/null
+++ b/.agents/skills/debug-agent/resources/checklist.md
@@ -0,0 +1,30 @@
+# Debug Agent - Self-Verification Checklist
+
+Run through every item before submitting your fix.
+
+## Fix Quality
+- [ ] Root cause identified (not just symptom patched)
+- [ ] Fix is minimal and focused (no unrelated changes)
+- [ ] Edge cases handled (null, empty, boundary values)
+- [ ] No new bugs introduced
+
+## Regression Test
+- [ ] Test written that fails without the fix
+- [ ] Test passes with the fix
+- [ ] Test covers the specific triggering condition
+- [ ] All existing tests still pass
+
+## Similar Patterns
+- [ ] Searched for same pattern elsewhere in codebase
+- [ ] Reported or fixed similar occurrences
+- [ ] Noted if systemic issue needs architectural fix
+
+## Documentation
+- [ ] Bug report saved to `.agents/brain/bugs/`
+- [ ] Root cause clearly explained
+- [ ] Prevention advice included
+- [ ] Files modified listed
+
+## Security Check (if applicable)
+- [ ] Fix doesn't introduce SQL injection, XSS, or auth bypass
+- [ ] Sensitive data not exposed in error messages or logs
diff --git a/.agents/skills/debug-agent/resources/common-patterns.md b/.agents/skills/debug-agent/resources/common-patterns.md
new file mode 100644
index 0000000..540c8a0
--- /dev/null
+++ b/.agents/skills/debug-agent/resources/common-patterns.md
@@ -0,0 +1,734 @@
+# Common Bug Patterns & Solutions
+
+Quick reference guide for frequently encountered bugs and their fixes.
+
+---
+
+## 🔴 Frontend Bugs
+
+### 1. Undefined/Null Errors
+
+**❌ Problem**: `Cannot read property 'X' of undefined`
+
+```typescript
+// Crash when data not loaded yet
+const name = user.profile.name;
+```
+
+**✅ Solutions**:
+
+```typescript
+// Option 1: Optional chaining + nullish coalescing
+const name = user?.profile?.name ?? 'Unknown';
+
+// Option 2: Conditional rendering
+{user?.profile && <div>{user.profile.name}</div>}
+
+// Option 3: Early return
+if (!user?.profile) return <div>Loading...</div>;
+```
+
+---
+
+### 2. Stale Closures in useEffect
+
+**❌ Problem**: Event handlers/callbacks use old state values
+
+```typescript
+function Counter() {
+  const [count, setCount] = useState(0);
+
+  useEffect(() => {
+    const interval = setInterval(() => {
+      console.log(count); // Always logs 0!
+    }, 1000);
+    return () => clearInterval(interval);
+  }, []); // Missing dependency
+
+  return <button onClick={() => setCount(c => c + 1)}>+</button>;
+}
+```
+
+**✅ Solutions**:
+
+```typescript
+// Option 1: Include dependency
+useEffect(() => {
+  const interval = setInterval(() => {
+    console.log(count); // Now updates!
+  }, 1000);
+  return () => clearInterval(interval);
+}, [count]); // Dependency added
+
+// Option 2: Use functional update
+useEffect(() => {
+  const interval = setInterval(() => {
+    setCount(c => {
+      console.log(c); // Current value
+      return c;
+    });
+  }, 1000);
+  return () => clearInterval(interval);
+}, []); // Can stay empty
+
+// Option 3: Use ref for latest value
+const countRef = useRef(count);
+countRef.current = count;
+
+useEffect(() => {
+  const interval = setInterval(() => {
+    console.log(countRef.current); // Latest value
+  }, 1000);
+  return () => clearInterval(interval);
+}, []);
+```
+
+---
+
+### 3. Missing Cleanup in useEffect
+
+**❌ Problem**: Memory leaks from subscriptions/listeners
+
+```typescript
+useEffect(() => {
+  const subscription = api.subscribe(data => setData(data));
+  // Missing cleanup!
+}, []);
+```
+
+**✅ Solution**:
+
+```typescript
+useEffect(() => {
+  const subscription = api.subscribe(data => setData(data));
+
+  return () => {
+    subscription.unsubscribe(); // Cleanup
+  };
+}, []);
+```
+
+**Common things that need cleanup**:
+- Event listeners (`addEventListener`)
+- Intervals (`setInterval`)
+- Timeouts (`setTimeout`)
+- Subscriptions (WebSockets, observables)
+- API requests (cancellation tokens)
+
+---
+
+### 4. Race Conditions in Async Effects
+
+**❌ Problem**: Old requests overwrite new ones
+
+```typescript
+useEffect(() => {
+  fetchUser(userId).then(setUser);
+  // If userId changes quickly, old responses arrive after new ones
+}, [userId]);
+```
+
+**✅ Solution**:
+
+```typescript
+useEffect(() => {
+  let cancelled = false;
+
+  fetchUser(userId).then(user => {
+    if (!cancelled) {
+      setUser(user);
+    }
+  });
+
+  return () => {
+    cancelled = true;
+  };
+}, [userId]);
+```
+
+---
+
+### 5. Infinite Re-render Loops
+
+**❌ Problem**: Component re-renders infinitely
+
+```typescript
+function Component() {
+  const [data, setData] = useState([]);
+
+  useEffect(() => {
+    setData([...data, 'new']); // Triggers effect again!
+  }, [data]); // Dependency causes loop
+
+  return <div>{data.length}</div>;
+}
+```
+
+**✅ Solutions**:
+
+```typescript
+// Option 1: Remove problematic dependency
+useEffect(() => {
+  setData(prevData => [...prevData, 'new']);
+}, []); // Empty deps - runs once
+
+// Option 2: Use ref instead of state
+const dataRef = useRef([]);
+
+useEffect(() => {
+  dataRef.current = [...dataRef.current, 'new'];
+}, []);
+
+// Option 3: Add condition
+useEffect(() => {
+  if (data.length === 0) { // Only run when empty
+    setData(['new']);
+  }
+}, [data]);
+```
+
+---
+
+### 6. Key Prop Issues in Lists
+
+**❌ Problem**: List items reordering incorrectly
+
+```typescript
+// Using index as key
+{todos.map((todo, index) => (
+  <TodoItem key={index} todo={todo} />
+))}
+```
+
+**✅ Solution**:
+
+```typescript
+// Use stable, unique ID
+{todos.map(todo => (
+  <TodoItem key={todo.id} todo={todo} />
+))}
+
+// If no ID, generate stable key
+{todos.map((todo, index) => (
+  <TodoItem key={`${todo.title}-${index}`} todo={todo} />
+))}
+```
+
+---
+
+### 7. Form Input Controlled/Uncontrolled Switch
+
+**❌ Problem**: `Warning: A component is changing an uncontrolled input to be controlled`
+
+```typescript
+const [value, setValue] = useState(); // undefined initially
+
+<input value={value} onChange={e => setValue(e.target.value)} />
+```
+
+**✅ Solution**:
+
+```typescript
+// Initialize with empty string
+const [value, setValue] = useState('');
+
+<input value={value} onChange={e => setValue(e.target.value)} />
+
+// Or use defaultValue for uncontrolled
+<input defaultValue="" onChange={e => console.log(e.target.value)} />
+```
+
+---
+
+## 🔴 Backend Bugs
+
+### 1. SQL Injection
+
+**❌ Problem**: User input directly in SQL query
+
+```python
+# DANGEROUS!
+email = request.args.get('email')
+query = f"SELECT * FROM users WHERE email = '{email}'"
+db.execute(query)
+# User can input: ' OR '1'='1
+```
+
+**✅ Solution**:
+
+```python
+# Use parameterized queries
+from sqlalchemy import text
+
+email = request.args.get('email')
+query = text("SELECT * FROM users WHERE email = :email")
+result = db.execute(query, {"email": email})
+
+# Or use ORM
+user = db.query(User).filter(User.email == email).first()
+```
+
+---
+
+### 2. N+1 Query Problem
+
+**❌ Problem**: One query per item in a loop
+
+```python
+# 1 query to get todos
+todos = db.query(Todo).all()
+
+# N queries (one per todo)
+for todo in todos:
+    user = db.query(User).filter(User.id == todo.user_id).first()
+    print(f"{todo.title} by {user.name}")
+```
+
+**✅ Solution**:
+
+```python
+# Use JOIN - single query
+from sqlalchemy.orm import joinedload
+
+todos = db.query(Todo).options(joinedload(Todo.user)).all()
+
+for todo in todos:
+    print(f"{todo.title} by {todo.user.name}") # No extra query
+```
+
+---
+
+### 3. Missing Authentication Check
+
+**❌ Problem**: Protected endpoint accessible without auth
+
+```python
+@app.get("/api/admin/users")
+async def get_all_users(db: DatabaseDep):
+    return db.query(User).all() # Anyone can access!
+```
+
+**✅ Solution**:
+
+```python
+@app.get("/api/admin/users")
+async def get_all_users(
+    db: DatabaseDep,
+    current_user: User = Depends(get_current_user) # Require auth
+):
+    if current_user.role != "admin": # Check role
+        raise HTTPException(403, "Admin only")
+    return db.query(User).all()
+```
+
+---
+
+### 4. Missing Input Validation
+
+**❌ Problem**: Invalid data causes errors
+
+```python
+@app.post("/api/users")
+async def create_user(email: str, age: int):
+    # No validation!
+    user = User(email=email, age=age)
+    db.add(user)
+    db.commit()
+```
+
+**✅ Solution**:
+
+```python
+from pydantic import BaseModel, EmailStr, Field
+
+class UserCreate(BaseModel):
+    email: EmailStr # Validates email format
+    age: int = Field(ge=0, le=150) # Must be 0-150
+
+@app.post("/api/users")
+async def create_user(user: UserCreate):
+    # Pydantic validates automatically
+    db_user = User(**user.model_dump())
+    db.add(db_user)
+    db.commit()
+```
+
+---
+
+### 5. Unhandled Exceptions
+
+**❌ Problem**: Server crashes on error
+
+```python
+@app.post("/api/todos")
+async def create_todo(todo: TodoCreate, user: User = Depends(get_current_user)):
+    db_todo = Todo(**todo.model_dump(), user_id=user.id)
+    db.add(db_todo)
+    db.commit() # Could fail!
+    return db_todo
+```
+
+**✅ Solution**:
+
+```python
+from fastapi import HTTPException
+
+@app.post("/api/todos")
+async def create_todo(todo: TodoCreate, user: User = Depends(get_current_user)):
+    try:
+        db_todo = Todo(**todo.model_dump(), user_id=user.id)
+        db.add(db_todo)
+        db.commit()
+        db.refresh(db_todo)
+        return db_todo
+    except IntegrityError as e:
+        db.rollback()
+        raise HTTPException(409, "Duplicate entry")
+    except Exception as e:
+        db.rollback()
+        logger.error(f"Failed to create todo: {e}")
+        raise HTTPException(500, "Internal server error")
+```
+
+---
+
+### 6. Missing CORS Configuration
+
+**❌ Problem**: Frontend can't call API
+
+```
+Access to fetch at 'http://localhost:8000/api/todos' from origin
+'http://localhost:3000' has been blocked by CORS policy
+```
+
+**✅ Solution**:
+
+```python
+from fastapi.middleware.cors import CORSMiddleware
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["http://localhost:3000"], # Frontend URL
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+# For production, be specific:
+# allow_origins=["https://yourdomain.com"]
+```
+
+---
+
+### 7. Password Storage
+
+**❌ Problem**: Passwords stored in plain text
+
+```python
+user = User(email=email, password=password) # NEVER DO THIS!
+```
+
+**✅ Solution**:
+
+```python
+from passlib.context import CryptContext
+
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+# Hash before storing
+password_hash = pwd_context.hash(password)
+user = User(email=email, password_hash=password_hash)
+
+# Verify on login
+if not pwd_context.verify(plain_password, user.password_hash):
+    raise HTTPException(401, "Invalid credentials")
+```
+
+---
+
+## 🔴 Mobile Bugs
+
+### 1. Memory Leaks in Flutter
+
+**❌ Problem**: Controllers not disposed
+
+```dart
+class MyWidget extends StatefulWidget {
+  @override
+  _MyWidgetState createState() => _MyWidgetState();
+}
+
+class _MyWidgetState extends State<MyWidget> {
+  final controller = TextEditingController();
+
+  @override
+  Widget build(BuildContext context) {
+    return TextField(controller: controller);
+  }
+  // Missing dispose!
+}
+```
+
+**✅ Solution**:
+
+```dart
+class _MyWidgetState extends State<MyWidget> {
+  final controller = TextEditingController();
+
+  @override
+  void dispose() {
+    controller.dispose(); // Clean up
+    super.dispose();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return TextField(controller: controller);
+  }
+}
+```
+
+---
+
+### 2. Platform-Specific Code Not Checked
+
+**❌ Problem**: iOS-specific code crashes on Android
+
+```dart
+// Crashes on Android
+import 'dart:io' show Platform;
+
+final deviceName = Platform.isIOS ? 'iPhone' : 'Unknown';
+```
+
+**✅ Solution**:
+
+```dart
+import 'dart:io' show Platform;
+
+final deviceName = Platform.isIOS
+    ? 'iPhone'
+    : Platform.isAndroid
+        ? 'Android'
+        : 'Unknown';
+
+// Or use conditional imports
+if (Platform.isIOS) {
+  // iOS-specific code
+} else if (Platform.isAndroid) {
+  // Android-specific code
+}
+```
+
+---
+
+## 🔴 Performance Bugs
+
+### 1. Unnecessary Re-renders (React)
+
+**❌ Problem**: Component re-renders on every parent render
+
+```typescript
+function Parent() {
+  const [count, setCount] = useState(0);
+
+  return (
+    <div>
+      <button onClick={() => setCount(c => c + 1)}>Count: {count}</button>
+      <ExpensiveChild data={someData} /> {/* Re-renders every time! */}
+    </div>
+  );
+}
+```
+
+**✅ Solution**:
+
+```typescript
+// Memoize the expensive component
+const ExpensiveChild = React.memo(function ExpensiveChild({ data }) {
+  // Only re-renders when data changes
+  return <div>{/* expensive computation */}</div>;
+});
+
+// Or memoize the props
+function Parent() {
+  const [count, setCount] = useState(0);
+  const memoizedData = useMemo(() => computeData(), []);
+
+  return (
+    <div>
+      <button onClick={() => setCount(c => c + 1)}>Count: {count}</button>
+      <ExpensiveChild data={memoizedData} />
+    </div>
+  );
+}
+```
+
+---
+
+### 2. Large Bundle Size
+
+**❌ Problem**: Importing entire library
+
+```typescript
+// Imports all of lodash (~70KB)
+import _ from 'lodash';
+
+const unique = _.uniq(array);
+```
+
+**✅ Solution**:
+
+```typescript
+// Import only what you need
+import uniq from 'lodash/uniq'; // ~2KB
+
+const unique = uniq(array);
+
+// Or use native methods
+const unique = [...new Set(array)];
+```
+
+---
+
+## 🔴 Security Bugs
+
+### 1. XSS (Cross-Site Scripting)
+
+**❌ Problem**: User input rendered as HTML
+
+```typescript
+// Dangerous!
+<div dangerouslySetInnerHTML={{ __html: userComment }} />
+```
+
+**✅ Solution**:
+
+```typescript
+// React escapes by default
+<div>{userComment}</div>
+
+// If HTML needed, sanitize first
+import DOMPurify from 'dompurify';
+
+<div dangerouslySetInnerHTML={{
+  __html: DOMPurify.sanitize(userComment)
+}} />
+```
+
+---
+
+### 2. Missing Rate Limiting
+
+**❌ Problem**: API can be abused
+
+```python
+@app.post("/api/auth/login")
+async def login(credentials: LoginRequest):
+    # No rate limiting - brute force possible!
+    ...
+```
+
+**✅ Solution**:
+
+```python
+from slowapi import Limiter
+from slowapi.util import get_remote_address
+
+limiter = Limiter(key_func=get_remote_address)
+
+@app.post("/api/auth/login")
+@limiter.limit("5/minute") # Max 5 attempts per minute
+async def login(request: Request, credentials: LoginRequest):
+    ...
+```
+
+---
+
+## 📊 Common Error Messages & Solutions
+
+| Error | Likely Cause | Solution |
+|-------|--------------|----------|
+| `Cannot read property 'X' of undefined` | Accessing property before data loads | Add null check or optional chaining |
+| `Maximum update depth exceeded` | Infinite re-render loop | Check useEffect dependencies |
+| `Warning: Each child should have unique key` | Missing/duplicate keys in list | Use unique, stable IDs as keys |
+| `401 Unauthorized` | Missing/invalid auth token | Check token in request headers |
+| `403 Forbidden` | Insufficient permissions | Verify user role/permissions |
+| `404 Not Found` | Wrong URL or resource doesn't exist | Check endpoint path and resource ID |
+| `500 Internal Server Error` | Backend exception | Check server logs for stack trace |
+| `CORS Error` | Cross-origin request blocked | Configure CORS middleware |
+| `ERR_CONNECTION_REFUSED` | Server not running | Start the backend server |
+
+---
+
+## 🎯 Quick Debugging Commands
+
+### Frontend
+```bash
+# Check for errors
+npm run lint
+
+# Run tests
+npm test
+
+# Build and check bundle size
+npm run build
+npm run analyze
+
+# Check for unused dependencies
+npx depcheck
+```
+
+### Backend
+```bash
+# Check for security issues
+pip install safety
+safety check
+
+# Run tests with coverage
+pytest --cov=app
+
+# Check for SQL injection
+bandit -r app/
+```
+
+### Mobile
+```bash
+# Check for issues
+flutter analyze
+
+# Run tests
+flutter test
+
+# Check app size
+flutter build apk --analyze-size
+```
+
+---
+
+## 🔍 When to Use Each Agent
+
+| Bug Type | Best Agent | Reason |
+|----------|-----------|---------|
+| Frontend crash | debug-agent | Specializes in bug diagnosis |
+| Backend API error | debug-agent | Can trace through stack |
+| Complex multi-domain | workflow-guide | Coordinates multiple agents |
+| Security vulnerability | qa-agent | Security expertise |
+| Performance issue | qa-agent | Performance profiling tools |
+| New feature needed | Specialist agent | Not a bug, it's a feature |
+
+---
+
+## 💡 Prevention Tips
+
+1. **Write tests first** - Catch bugs before they ship
+2. **Use TypeScript** - Catch type errors at compile time
+3. **Enable strict mode** - More safety checks
+4. **Code review** - Second pair of eyes
+5. **Automated linting** - Enforce best practices
+6. **Error monitoring** - Sentry, LogRocket, etc.
+7. **User testing** - Real users find real bugs
+
+---
+
+**Remember**: The best bug is the one that never happens. Write defensive code, test thoroughly, and document lessons learned!
diff --git a/.agents/skills/debug-agent/resources/debugging-checklist.md b/.agents/skills/debug-agent/resources/debugging-checklist.md
new file mode 100644
index 0000000..09fbf8e
--- /dev/null
+++ b/.agents/skills/debug-agent/resources/debugging-checklist.md
@@ -0,0 +1,362 @@
+# Debugging Checklist
+
+Use this checklist when investigating bugs to ensure thorough analysis.
+
+## 📋 Initial Information Gathering
+
+- [ ] **Bug description** - What is the expected vs actual behavior?
+- [ ] **Error messages** - Exact error text, stack trace, error codes
+- [ ] **Reproduction steps** - Clear, numbered steps to trigger the bug
+- [ ] **Frequency** - Every time, intermittent, specific conditions?
+- [ ] **Environment** - Browser/OS/version, mobile device, server environment
+- [ ] **User impact** - How many users affected? Severity?
+- [ ] **Recent changes** - New deploy? Code changes? Configuration updates?
+- [ ] **Screenshots/videos** - Visual evidence of the bug
+
+## 🔍 Frontend Debugging
+
+### JavaScript/TypeScript Errors
+
+- [ ] Check browser console (F12) for errors
+- [ ] Review stack trace - which file and line?
+- [ ] Identify error type (TypeError, ReferenceError, etc.)
+- [ ] Check for null/undefined values
+- [ ] Verify variable types (especially after API calls)
+- [ ] Look for typos in property names
+
+### React Component Issues
+
+- [ ] **State problems**
+  - [ ] State not updating? (need setState/useState)
+  - [ ] Stale state in closures? (use refs or functional updates)
+  - [ ] State out of sync with props?
+
+- [ ] **Effect problems**
+  - [ ] Missing dependencies in useEffect?
+  - [ ] Effect running too many times?
+  - [ ] Cleanup function needed?
+  - [ ] Memory leak from uncancelled requests?
+
+- [ ] **Rendering issues**
+  - [ ] Conditional rendering logic correct?
+  - [ ] Keys on list items unique and stable?
+  - [ ] Unnecessary re-renders? (use React DevTools Profiler)
+
+### UI/UX Issues
+
+- [ ] CSS not applying? (check specificity, typos)
+- [ ] Layout broken? (check responsive breakpoints)
+- [ ] Accessibility issues? (keyboard nav, screen reader)
+- [ ] Dark mode broken?
+- [ ] Mobile-specific issues?
+
+### API Integration
+
+- [ ] **Network tab investigation**
+  - [ ] Request sent? (check Headers tab)
+  - [ ] Correct endpoint URL?
+  - [ ] Proper HTTP method (GET, POST, etc.)?
+  - [ ] Headers included (Authorization, Content-Type)?
+  - [ ] Request body formatted correctly?
+  - [ ] Response status code (200, 401, 404, 500)?
+  - [ ] Response data structure matches expected?
+
+- [ ] **Error handling**
+  - [ ] Try/catch around API calls?
+  - [ ] Error state displayed to user?
+  - [ ] Timeout handling?
+  - [ ] Network failure handling?
+
+- [ ] **Loading states**
+  - [ ] Loading spinner shown?
+  - [ ] Disabled buttons during load?
+  - [ ] Optimistic updates causing issues?
+
+## 🖥️ Backend Debugging
+
+### Python/FastAPI Errors
+
+- [ ] **Stack trace analysis**
+  - [ ] Read error message carefully
+  - [ ] Identify the failing file and line
+  - [ ] Understand the error type (ValueError, KeyError, etc.)
+  - [ ] Check for None values
+  - [ ] Verify data types
+
+- [ ] **Database issues**
+  - [ ] Query syntax correct?
+  - [ ] N+1 query problem?
+  - [ ] Missing JOIN?
+  - [ ] Indexes present on filtered columns?
+  - [ ] Connection pool exhausted?
+  - [ ] Transaction isolation issues?
+
+- [ ] **Authentication/Authorization**
+  - [ ] Token validation working?
+  - [ ] Token expired?
+  - [ ] Permissions checked correctly?
+  - [ ] User session valid?
+  - [ ] CORS configured properly?
+
+### API Endpoint Issues
+
+- [ ] **Request validation**
+  - [ ] Pydantic schema matches request?
+  - [ ] Required fields present?
+  - [ ] Field types correct?
+  - [ ] Value ranges validated?
+
+- [ ] **Response formatting**
+  - [ ] Correct status code?
+  - [ ] Response schema matches contract?
+  - [ ] Error responses formatted properly?
+  - [ ] Pagination working?
+
+- [ ] **Performance**
+  - [ ] Response time acceptable (<200ms)?
+  - [ ] Query optimization needed?
+  - [ ] Caching implemented?
+  - [ ] Rate limiting working?
+
+### Server Issues
+
+- [ ] **Logs examination**
+  - [ ] Check application logs
+  - [ ] Check error logs
+  - [ ] Check access logs
+  - [ ] Timestamps correlate with bug reports?
+
+- [ ] **Environment**
+  - [ ] Environment variables set?
+  - [ ] Configuration correct for environment (dev/prod)?
+  - [ ] External services reachable?
+  - [ ] Database migrations applied?
+
+## 📱 Mobile Debugging
+
+### Platform-Specific Issues
+
+- [ ] **iOS vs Android differences**
+  - [ ] Test on both platforms
+  - [ ] Check platform-specific code (Platform.OS)
+  - [ ] Review native module integration
+  - [ ] Verify permissions (camera, location, etc.)
+
+- [ ] **Device-specific**
+  - [ ] Test on actual device (not just emulator)
+  - [ ] Check different screen sizes
+  - [ ] Test different OS versions
+  - [ ] Memory constraints on older devices?
+
+### Flutter-Specific
+
+- [ ] **Widget tree issues**
+  - [ ] State management correct? (Riverpod/Bloc)
+  - [ ] Build method pure?
+  - [ ] Keys used properly?
+  - [ ] Dispose called for controllers?
+
+- [ ] **Platform channels**
+  - [ ] Native code errors?
+  - [ ] Method channel names correct?
+  - [ ] Data serialization working?
+
+### Mobile Performance
+
+- [ ] Memory leaks? (listeners not disposed)
+- [ ] Excessive rebuilds?
+- [ ] Large images not optimized?
+- [ ] Too many simultaneous network requests?
+
+## 🔐 Security Bugs
+
+- [ ] **Authentication bypassed?**
+  - [ ] Token validation on all protected routes?
+  - [ ] Token expiry checked?
+  - [ ] Refresh token flow secure?
+
+- [ ] **Authorization broken?**
+  - [ ] User can access others' data?
+  - [ ] Admin functions accessible to regular users?
+  - [ ] Horizontal privilege escalation possible?
+
+- [ ] **Injection vulnerabilities**
+  - [ ] SQL injection? (use parameterized queries)
+  - [ ] XSS? (sanitize user input)
+  - [ ] Command injection?
+  - [ ] Path traversal?
+
+- [ ] **Data exposure**
+  - [ ] Sensitive data in logs?
+  - [ ] Passwords in plain text?
+  - [ ] API keys exposed?
+  - [ ] Error messages leaking info?
+
+## 🐌 Performance Bugs
+
+### Frontend Performance
+
+- [ ] **Lighthouse audit**
+  - [ ] Performance score >90?
+  - [ ] First Contentful Paint <1.5s?
+  - [ ] Largest Contentful Paint <2.5s?
+  - [ ] Cumulative Layout Shift <0.1?
+
+- [ ] **Bundle analysis**
+  - [ ] Main bundle <500KB?
+  - [ ] Code splitting implemented?
+  - [ ] Large dependencies tree-shaken?
+  - [ ] Lazy loading used?
+
+- [ ] **React performance**
+  - [ ] Unnecessary re-renders? (React DevTools Profiler)
+  - [ ] Memo/useMemo/useCallback used appropriately?
+  - [ ] Virtual scrolling for long lists?
+
+### Backend Performance
+
+- [ ] **API latency**
+  - [ ] p95 response time <200ms?
+  - [ ] Slow queries identified?
+  - [ ] Indexes added?
+  - [ ] Caching implemented?
+
+- [ ] **Database**
+  - [ ] Connection pooling configured?
+  - [ ] Query plan optimized? (EXPLAIN)
+  - [ ] N+1 queries eliminated?
+
+## 🔬 Root Cause Analysis
+
+- [ ] **Reproduce the bug**
+  - [ ] Follow exact reproduction steps
+  - [ ] Confirm bug exists
+  - [ ] Note any variations
+
+- [ ] **Isolate the problem**
+  - [ ] Which component/function fails?
+  - [ ] What input triggers it?
+  - [ ] What conditions must be met?
+
+- [ ] **Trace the data flow**
+  - [ ] Where does the bad data come from?
+  - [ ] How is it transformed?
+  - [ ] Where does it cause the failure?
+
+- [ ] **Identify the root cause**
+  - [ ] Not just the symptom
+  - [ ] Why does this happen?
+  - [ ] What assumption was wrong?
+
+## ✅ Fix Verification
+
+- [ ] **Fix applied**
+  - [ ] Code changed in correct file(s)
+  - [ ] Logic correct
+  - [ ] Edge cases handled
+  - [ ] No new bugs introduced
+
+- [ ] **Testing**
+  - [ ] Regression test written
+  - [ ] Test passes
+  - [ ] Manual verification done
+  - [ ] Edge cases tested
+
+- [ ] **Related areas checked**
+  - [ ] Similar patterns elsewhere?
+  - [ ] Other code depending on this?
+  - [ ] Breaking changes avoided?
+
+- [ ] **Documentation**
+  - [ ] Bug documented in Knowledge Base
+  - [ ] Fix explained
+  - [ ] Prevention notes added
+
+## 🚨 When to Escalate
+
+Escalate to other agents if:
+
+- [ ] Bug spans multiple domains → **workflow-guide**
+- [ ] Requires architectural change → **PM Agent**
+- [ ] Need comprehensive security audit → **QA Agent**
+- [ ] Complex frontend refactoring needed → **Frontend Agent**
+- [ ] Database schema changes needed → **Backend Agent**
+- [ ] Platform-specific mobile issue → **Mobile Agent**
+
+## 📊 Priority Assessment
+
+**🔴 CRITICAL** - Fix immediately:
+- [ ] App crashes on launch
+- [ ] Data loss or corruption
+- [ ] Security vulnerability
+- [ ] Payment/auth completely broken
+- [ ] Affects all users
+
+**🟠 HIGH** - Fix within 24 hours:
+- [ ] Major feature broken
+- [ ] Affects >50% of users
+- [ ] No workaround available
+- [ ] Significant revenue impact
+
+**🟡 MEDIUM** - Fix within sprint:
+- [ ] Minor feature broken
+- [ ] Affects <50% of users
+- [ ] Workaround exists
+- [ ] Moderate inconvenience
+
+**🔵 LOW** - Schedule for future:
+- [ ] Edge case
+- [ ] Cosmetic issue
+- [ ] Rarely encountered
+- [ ] No user impact
+
+## 📝 Documentation Template
+
+After fixing, document in `.agents/brain/bugs/`:
+
+```markdown
+# Bug: [Title]
+**Date**: YYYY-MM-DD
+**Severity**: CRITICAL/HIGH/MEDIUM/LOW
+**Status**: FIXED
+
+## Problem
+[What was broken]
+
+## Root Cause
+[Why it was broken]
+
+## Fix
+[What was changed]
+
+## Files Modified
+- path/to/file
+
+## Testing
+- [x] Regression test added
+- [x] Manual verification
+- [x] Related areas checked
+
+## Prevention
+[How to avoid in future]
+```
+
+---
+
+## 💡 Pro Tips
+
+1. **Read the error message** - It usually tells you exactly what's wrong
+2. **Reproduce first** - Don't waste time fixing unconfirmed bugs
+3. **One change at a time** - Don't fix multiple things simultaneously
+4. **Test thoroughly** - Verify the fix and check for regressions
+5. **Document everything** - Future you will be grateful
+6. **Look for patterns** - One bug often reveals more
+
+## 🛠️ Tools Reference
+
+- **Browser DevTools**: F12 (Console, Network, React DevTools)
+- **Serena MCP**: find_symbol, search_for_pattern, find_referencing_symbols
+- **Antigravity Browser**: Automated testing and reproduction
+- **React Profiler**: Performance analysis
+- **Lighthouse**: Performance audit
+- **Git bisect**: Find when bug was introduced
diff --git a/.agents/skills/debug-agent/resources/error-playbook.md b/.agents/skills/debug-agent/resources/error-playbook.md
new file mode 100644
index 0000000..1174ecc
--- /dev/null
+++ b/.agents/skills/debug-agent/resources/error-playbook.md
@@ -0,0 +1,94 @@
+# Debug Agent - Error Recovery Playbook
+
+When you encounter a failure during debugging, follow these recovery steps.
+Do NOT stop or ask for help until you have exhausted the playbook.
+
+---
+
+## Cannot Reproduce the Bug
+
+**Symptoms**: Bug described by user but you can't trigger it
+
+1. Re-read user's reproduction steps — are you following them exactly?
+2. Check environment differences: browser, OS, node/python version
+3. Check data-dependent: does it need specific DB state or test data?
+4. Check timing: is it a race condition? Try adding delays or rapid repetition
+5. **After 3 attempts**: Record `Status: cannot_reproduce` in result with condition list
+   - NEVER give up immediately saying "cannot reproduce"
+
+---
+
+## Fix Introduces New Failure
+
+**Symptoms**: Original bug fixed but other tests break
+
+1. Read the failing tests — are they testing the old (buggy) behavior?
+2. If yes: update tests to reflect correct behavior
+3. If no: your fix has side effects — revert and try a more targeted approach
+4. `find_referencing_symbols("fixedFunction")` to check all callers
+5. Consider: is the function contract changing? If so, update all callers
+
+---
+
+## Root Cause Unclear
+
+**Symptoms**: You see the failure but can't trace why
+
+1. Add logging at each step of the execution path
+2. Binary search: is the bug before or after the midpoint?
+3. `search_for_pattern("suspicious_pattern")` to find related code
+4. Check git history: `git log --oneline -20 -- path/to/file` — when was it last changed?
+5. Check: is it a dependency issue? Library version mismatch?
+6. **No progress after 5 turns**: Record current analysis in progress, switch to different hypothesis
+
+---
+
+## Bug Is in Another Agent's Domain
+
+**Symptoms**: Frontend bug caused by backend API, or vice versa
+
+1. Confirm: is the root cause really in the other domain?
+2. Document the cross-domain issue clearly:
+   - Which endpoint/component is wrong
+   - What the correct behavior should be
+   - Evidence (request/response logs, stack trace)
+3. Record in result: `cross_domain_issue: {agent: "backend", description: "..."}`
+4. **Do NOT modify directly** — touching another agent's code causes conflicts
+
+---
+
+## Performance Bug Hard to Measure
+
+**Symptoms**: "It's slow" but no clear metric
+
+1. Establish baseline: measure current response time / render time
+2. Backend: enable SQL query logging, count queries, check `EXPLAIN ANALYZE`
+3. Frontend: run Lighthouse, check React DevTools Profiler
+4. Mobile: use Flutter DevTools performance tab
+5. Profile before fixing — never optimize without data
+
+---
+
+## Test Cannot Be Written
+
+**Symptoms**: Bug is real but hard to test (race condition, environment-specific)
+
+1. Try: mock the timing / environment condition
+2. Try: integration test instead of unit test
+3. If truly untestable: document the manual reproduction steps
+4. Add a comment in code explaining why the fix is correct
+5. Note in result: `test_limitation: "reason why automated test is not feasible"`
+
+---
+
+## Rate Limit / Quota / Memory Fallback
+
+Same as backend-agent playbook: See relevant sections.
+
+---
+
+## General Principles
+
+- **After 3 failures**: If same approach fails 3 times, must try a different method
+- **Blocked**: If no progress after 5 turns, save current state, `Status: blocked`
+- **Out of scope**: Other agent's domain — only record, do not modify directly
diff --git a/.agents/skills/debug-agent/resources/examples.md b/.agents/skills/debug-agent/resources/examples.md
new file mode 100644
index 0000000..63ed718
--- /dev/null
+++ b/.agents/skills/debug-agent/resources/examples.md
@@ -0,0 +1,87 @@
+# Debug Agent - Examples
+
+## Example 1: Null Reference Error
+
+**Input**: "TodoList crashes with 'Cannot read property map of undefined'"
+
+**Output**:
+```
+## Bug Analysis
+
+**Root Cause**: TodoList renders before API data loads. `todos` is undefined
+on first render, and `.map()` is called immediately.
+
+**Why**: useEffect fetches async, but component doesn't guard against
+undefined initial state.
+
+## Fix
+- Before: `todos.map(t => <TodoItem ... />)`
+- After: `todos?.map(t => <TodoItem ... />) ?? <EmptyState />`
+- Also added loading spinner while fetching
+
+## Changes Made
+1. Added `if (isLoading) return <Spinner />`
+2. Added optional chaining on `todos?.map()`
+3. Added empty state component
+
+## Files Modified
+- src/components/TodoList.tsx (guard + loading state)
+- src/components/EmptyState.tsx (NEW)
+- tests/TodoList.test.tsx (regression test)
+
+## Prevention
+Use TanStack Query which provides `isLoading`/`data` pattern by default.
+```
+
+## Example 2: N+1 Query Performance Bug
+
+**Input**: "The posts page takes 3 seconds to load with only 50 posts"
+
+**Output**:
+```
+## Bug Analysis
+
+**Root Cause**: N+1 query. For each post, a separate SQL query fetches
+the author. 50 posts = 51 queries.
+
+**Why**: SQLAlchemy lazy-loads relationships by default.
+
+## Fix
+- Before: `db.query(Post).all()`
+- After: `db.query(Post).options(joinedload(Post.author)).all()`
+
+## Changes Made
+1. Added eager loading with joinedload
+2. Load time: 3000ms -> 45ms
+
+## Files Modified
+- app/api/posts.py (eager loading)
+- tests/test_posts.py (performance assertion: < 200ms)
+```
+
+## Example 3: Race Condition
+
+**Input**: "Search results show wrong data when typing fast"
+
+**Output**:
+```
+## Bug Analysis
+
+**Root Cause**: Race condition. Fast typing triggers multiple API calls.
+Slower early requests resolve after faster recent ones, overwriting
+correct results.
+
+**Why**: No request cancellation; last-write-wins causes stale data.
+
+## Fix
+Added AbortController to cancel previous request on new keystroke.
+
+## Changes Made
+1. useEffect cleanup cancels pending request
+2. Added debounce (300ms) to reduce API calls
+3. Added `cancelled` flag to ignore stale responses
+
+## Files Modified
+- src/hooks/useSearch.ts (abort + debounce)
+- tests/useSearch.test.ts (race condition test)
+```
diff --git a/.agents/skills/debug-agent/resources/execution-protocol.md b/.agents/skills/debug-agent/resources/execution-protocol.md
new file mode 100644
index 0000000..91df681
--- /dev/null
+++ b/.agents/skills/debug-agent/resources/execution-protocol.md
@@ -0,0 +1,51 @@
+# Debug Agent - Execution Protocol
+
+## Step 0: Prepare
+1. **Assess difficulty** — see `../_shared/difficulty-guide.md`
+   - **Simple**: Skip to Step 3 | **Medium**: All 4 steps | **Complex**: All steps + checkpoints
+2. **Check lessons** — read your domain section in `../_shared/lessons-learned.md`
+3. **Clarify requirements** — follow `../_shared/clarification-protocol.md`
+   - Check **Uncertainty Triggers**: security/auth related bugs, existing code conflict potential?
+   - Determine level: LOW → proceed | MEDIUM → present options | HIGH → ask immediately
+4. **Use reasoning templates** — for Complex bugs, use `../_shared/reasoning-templates.md` (hypothesis loop, execution trace)
+5. **Budget context** — follow `../_shared/context-budget.md` (use find_symbol, not read_file)
+
+**⚠️ Intelligent Escalation**: When uncertain, escalate early. Don't blindly proceed.
+
+Follow these steps in order (adjust depth by difficulty).
+
+## Step 1: Understand
+- Gather: What happened? What was expected? Error messages? Steps to reproduce?
+- Read relevant code using Serena:
+  - `find_symbol("functionName")`: Locate the failing function
+  - `find_referencing_symbols("Component")`: Find all callers
+  - `search_for_pattern("error pattern")`: Find similar issues
+- Classify: logic bug, runtime error, performance issue, security flaw, or integration failure
+
+## Step 2: Reproduce & Diagnose
+- Trace execution flow from entry point to failure
+- Identify the exact line and condition that causes the bug
+- Determine root cause (not just symptom):
+  - Null/undefined access?
+  - Race condition?
+  - Missing validation?
+  - Wrong assumption about data shape?
+- Check `resources/common-patterns.md` for known patterns
+
+## Step 3: Fix & Test
+- Apply minimal fix that addresses the root cause
+- Write a regression test that:
+  - Fails without the fix
+  - Passes with the fix
+  - Covers the specific edge case
+- Check for similar patterns elsewhere: `search_for_pattern("same_bug_pattern")`
+- If found, fix proactively or report them
+
+## Step 4: Document & Verify
+- Run `resources/checklist.md` items
+- Save bug report to `.agents/brain/bugs/` using `resources/bug-report-template.md`
+- Include: root cause, fix, prevention advice
+- Verify no regressions in related functionality
+
+## On Error
+See `resources/error-playbook.md` for recovery steps.
diff --git a/.agents/skills/devops-iac-engineer/SKILL.md b/.agents/skills/devops-iac-engineer/SKILL.md
deleted file mode 100644
index 600f66a..0000000
--- a/.agents/skills/devops-iac-engineer/SKILL.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-name: devops-iac-engineer
-description: Expert guidance for designing, implementing, and maintaining cloud infrastructure using Experience in Infrastructure as Code (IaC) principles. Use this skill for architecting cloud solutions, setting up CI/CD pipelines, implementing observability, and following SRE best practices.
----
-
-# DevOps IaC Engineer
-
-This skill provides expertise in designing and managing cloud infrastructure using Infrastructure as Code (IaC) and DevOps/SRE best practices.
-
-## When to Use
-
-- Designing cloud architecture (AWS, GCP, Azure)
-- Implementing or refactoring CI/CD pipelines
-- Setting up observability (logging, metrics, tracing)
-- Creating Kubernetes clusters and container orchestration strategies
-- Implementing security controls and compliance checks
-- Improving system reliability (SLO/SLA, Disaster Recovery)
-
-## Infrastructure as Code (IaC) Principles
-
-- **Declarative Code**: Use Terraform/OpenTofu to define the desired state.
-- **GitOps**: Code repository is the single source of truth. Changes are applied via PRs and automated pipelines.
-- **Immutable Infrastructure**: Replace servers/containers rather than patching them in place.
-
-## Core Domains
-
-### 1. Terraform & IaC
-- Use modules for reusability.
-- Separate state by environment (dev, stage, prod) and region.
-- Automate `plan` and `apply` in CI/CD.
-
-### 2. Kubernetes & Containers
-- Build small, stateless containers.
-- Use Helm or Kustomize for resource management.
-- Implement resource limits and requests.
-- Use namespaces for isolation.
-
-### 3. CI/CD Pipelines
-- **CI**: Lint, test, build, and scan (security) on every commit.
-- **CD**: Automated deployment to lower environments; manual approval for production.
-- Use tools like GitHub Actions, Cloud Build, or ArgoCD.
-
-### 4. Observability
-- **Logs**: Centralized logging (e.g., Cloud Logging, ELK).
-- **Metrics**: Prometheus/Grafana or Cloud Monitoring.
-- **Tracing**: OpenTelemetry for distributed tracing.
-
-### 5. Security (DevSecOps)
-- Scan IaC for misconfigurations (e.g., Checkov, Trivy).
-- Manage secrets utilizing Secret Manager or Vault (never in code).
-- Least privilege IAM roles.
-
-## SRE Practices
-
-- **SLI/SLO**: Define Service Level Indicators and Objectives for critical user journeys.
-- **Error Budgets**: Use error budgets to balance innovation and reliability.
-- **Post-Mortems**: Conduct blameless post-mortems for incidents.
diff --git a/.agents/skills/frontend-agent/SKILL.md b/.agents/skills/frontend-agent/SKILL.md
new file mode 100644
index 0000000..4e2938d
--- /dev/null
+++ b/.agents/skills/frontend-agent/SKILL.md
@@ -0,0 +1,152 @@
+---
+name: frontend-agent
+description: Frontend specialist for React, Next.js, TypeScript with FSD-lite architecture, shadcn/ui, and design system alignment. Use for UI, component, page, layout, CSS, Tailwind, and shadcn work.
+---
+
+# Frontend Agent - UI/UX Specialist
+
+## When to use
+- Building user interfaces and components
+- Client-side logic and state management
+- Styling and responsive design
+- Form validation and user interactions
+- Integrating with backend APIs
+
+## When NOT to use
+- Backend API implementation -> use Backend Agent
+- Native mobile development -> use Mobile Agent
+
+## Core Rules
+
+1. **Component Reuse**: Use `shadcn/ui` components first. Extend via `cva` variants or composition. Avoid custom CSS.
+2. **Design Fidelity**: Code must map 1:1 to Design Tokens. Resolve discrepancies before implementation.
+3. **Rendering Strategy**: Default to Server Components for performance. Use Client Components only for interactivity and API integration.
+4. **Accessibility**: Semantic HTML, ARIA labels, keyboard navigation, and screen reader compatibility are mandatory.
+5. **Tool First**: Check for existing solutions and tools before coding.
+
+## 1. Tooling & Performance
+
+- **Metrics**: Target First Contentful Paint (FCP) < 1s.
+- **Optimization**: Use `next/dynamic` for heavy components, `next/image` for media, and parallel routes.
+- **Responsive Breakpoints**: 320px, 768px, 1024px, 1440px
+- **Shadcn Workflow**:
+  1. Search: `shadcn_search_items_in_registries`
+  2. Review: `shadcn_get_item_examples_from_registries`
+  3. Install: `shadcn_get_add_command_for_items`
+
+## 2. Architecture (FSD-lite)
+
+- **Root (`src/`)**: Shared logic (components, lib, types). Hoist common code here.
+- **Feature (`src/features/*/`)**: Feature-specific logic. **No cross-feature imports.** Unidirectional flow only.
+
+### Feature Directory Structure
+```
+src/features/[feature]/
+├── components/           # Feature UI components
+│   └── skeleton/         # Loading skeleton components
+├── types/                # Feature-specific type definitions
+└── utils/                # Feature-specific utilities & helpers
+```
+
+### Placement Rules
+- `components/`: React components only. One component per file.
+- `types/`: TypeScript interfaces and type definitions.
+- `utils/`: All feature-specific logic (formatters, validators, helpers). **Requires >90% test coverage** for custom logic.
+
+> **Note**: Feature level does NOT have `lib/` folder. Use `utils/` for all utilities. `lib/` exists only at root `src/lib/` level.
+
+## 3. Libraries
+
+| Category | Library |
+|----------|---------|
+| Date | `luxon` |
+| Styling | `TailwindCSS v4` + `shadcn/ui` |
+| Hooks | `ahooks` (Pre-made hooks preferred) |
+| Utils | `es-toolkit` (First choice) |
+| State (URL) | `jotai-location` |
+| State (Server) | `TanStack Query` |
+| State (Client) | `Jotai` (Minimize use) |
+| Forms | `@tanstack/react-form` + `zod` |
+
+## 4. Standards
+
+- **Utilities**: Check `es-toolkit` first. If implementing custom logic, **>90% Unit Test Coverage** is MANDATORY.
+- **Design Tokens**: Source of Truth is `packages/design-tokens` (OKLCH). Never hardcode colors.
+- **i18n**: Source of Truth is `packages/i18n`. Never hardcode strings.
+
+## 5. Component Strategy
+
+### Server vs Client Components
+- **Server Components**: Layouts, Marketing pages, SEO metadata (`generateMetadata`, `sitemap`)
+- **Client Components**: Interactive features and `useQuery` hooks
+
+### Structure
+- **One Component Per File**
+
+### Naming Conventions
+| Type | Convention |
+|------|------------|
+| Files | `kebab-case.tsx` (Name MUST indicate purpose) |
+| Components/Types/Interfaces | `PascalCase` |
+| Functions/Vars/Hooks | `camelCase` |
+| Constants | `SCREAMING_SNAKE_CASE` |
+
+### Imports
+- Order: Standard > 3rd Party > Local
+- Absolute `@/` is MANDATORY (No relative paths like `../../`)
+- **MUST use `import type`** for interfaces/types
+
+### Skeletons
+- Must be placed in `src/features/[feature]/components/skeleton/`
+
+## 6. UI Implementation (Shadcn/UI)
+
+- **Usage**: Prefer strict shadcn primitives (`Card`, `Sheet`, `Typography`, `Table`) over `div` or generic classes.
+- **Responsiveness**: Use `Drawer` (Mobile) vs `Dialog` (Desktop) via `useResponsive`.
+- **Customization Rule**: Treat `components/ui/*` as read-only. Do not modify directly.
+  - **Correct**: Create a wrapper (e.g., `components/common/ProductButton.tsx`) or use `cva` composition.
+  - **Incorrect**: Editing `components/ui/button.tsx`.
+
+## 7. Designer Collaboration
+
+- **Sync**: Map code variables to Figma layer names.
+- **UX**: Ensure key actions are visible "Above the Fold".
+
+## How to Execute
+
+Follow `resources/execution-protocol.md` step by step.
+See `resources/examples.md` for input/output examples.
+Before submitting, run `resources/checklist.md`.
+
+## Review Checklist
+
+- [ ] **A11y**: Interactive elements have `aria-label`. Semantic headings (`h1`-`h6`).
+- [ ] **Mobile**: Functionality verified on mobile viewports.
+- [ ] **Performance**: No CLS, fast load.
+- [ ] **Resilience**: Error Boundaries and Loading Skeletons implemented.
+- [ ] **Tests**: Logic covered by Vitest where complex.
+- [ ] **Quality**: Typecheck and Lint pass.
+
+## Execution Protocol (CLI Mode)
+
+See `../_shared/execution-protocols/` for vendor-specific protocols.
+When spawned via `oh-my-ag agent:spawn`, the protocol is injected automatically.
+
+## References
+
+- Execution steps: `resources/execution-protocol.md`
+- Code examples: `resources/examples.md`
+- Code snippets: `resources/snippets.md`
+- Checklist: `resources/checklist.md`
+- Error recovery: `resources/error-playbook.md`
+- Tech stack: `resources/tech-stack.md`
+- Component template: `resources/component-template.tsx`
+- Tailwind rules: `resources/tailwind-rules.md`
+- Context loading: `../_shared/context-loading.md`
+- Reasoning templates: `../_shared/reasoning-templates.md`
+- Clarification: `../_shared/clarification-protocol.md`
+- Context budget: `../_shared/context-budget.md`
+- Lessons learned: `../_shared/lessons-learned.md`
+
+> [!IMPORTANT]
+> Treat `components/ui/*` as read-only. Create wrappers for customization.
diff --git a/.agents/skills/frontend-agent/resources/checklist.md b/.agents/skills/frontend-agent/resources/checklist.md
new file mode 100644
index 0000000..ae34d11
--- /dev/null
+++ b/.agents/skills/frontend-agent/resources/checklist.md
@@ -0,0 +1,38 @@
+# Frontend Agent - Self-Verification Checklist
+
+Run through every item before submitting your work.
+
+## TypeScript
+- [ ] Strict mode, no `any` types
+- [ ] Explicit interfaces for all component props
+- [ ] No TypeScript errors (`npx tsc --noEmit`)
+
+## Styling
+- [ ] Tailwind CSS only (no inline styles, no CSS modules)
+- [ ] Responsive at 320px, 768px, 1024px, 1440px
+- [ ] Dark mode supported (if project uses it)
+- [ ] No hardcoded colors (use Tailwind theme tokens)
+
+## Accessibility (WCAG 2.1 AA)
+- [ ] Semantic HTML elements (`<nav>`, `<main>`, `<button>`)
+- [ ] All images have alt text
+- [ ] Color contrast >= 4.5:1 (normal text), >= 3:1 (large text)
+- [ ] Keyboard navigation works for all interactive elements
+- [ ] ARIA labels on non-obvious interactive elements
+- [ ] Focus indicators visible
+
+## UX States
+- [ ] Loading state (skeleton or spinner)
+- [ ] Error state (user-friendly message + retry action)
+- [ ] Empty state (helpful message + CTA)
+- [ ] Optimistic updates where appropriate
+
+## Performance
+- [ ] No unnecessary re-renders (check with React DevTools Profiler)
+- [ ] Code splitting for route-level components
+- [ ] Images optimized and lazy-loaded
+
+## Testing
+- [ ] Unit tests for components with logic
+- [ ] User interactions tested (click, type, submit)
+- [ ] Async behavior tested (loading -> data -> display)
diff --git a/.agents/skills/frontend-agent/resources/component-template.tsx b/.agents/skills/frontend-agent/resources/component-template.tsx
new file mode 100644
index 0000000..e5da13f
--- /dev/null
+++ b/.agents/skills/frontend-agent/resources/component-template.tsx
@@ -0,0 +1,93 @@
+/**
+ * Component Template for Frontend Agent
+ *
+ * This is a reference template for creating new components.
+ * Follow this structure for consistency.
+ */
+
+import type { ReactNode } from "react";
+import { cn } from "@/lib/utils";
+
+// 1. Type Definitions
+interface ComponentNameProps {
+  className?: string;
+  children: ReactNode;
+  // Add specific props here
+  variant?: "default" | "primary" | "secondary";
+  size?: "sm" | "md" | "lg";
+  onClick?: () => void;
+  disabled?: boolean;
+}
+
+// 2. Main Component
+export function ComponentName({
+  className,
+  children,
+  variant = "default",
+  size = "md",
+  onClick,
+  disabled = false,
+}: ComponentNameProps) {
+  // 3. Hooks (if needed)
+  // const [state, setState] = useState();
+
+  // 4. Effects (if needed)
+  // useEffect(() => {}, []);
+
+  // 5. Event Handlers
+  const handleClick = () => {
+    if (disabled) return;
+    onClick?.();
+  };
+
+  // 6. Computed Values
+  const classes = cn(
+    // Base styles
+    "inline-flex items-center justify-center rounded-md font-medium transition-colors",
+    // Variants
+    {
+      "bg-primary text-primary-foreground hover:bg-primary/90":
+        variant === "primary",
+      "bg-secondary text-secondary-foreground hover:bg-secondary/80":
+        variant === "secondary",
+      "bg-background text-foreground hover:bg-accent": variant === "default",
+    },
+    // Sizes
+    {
+      "h-8 px-3 text-sm": size === "sm",
+      "h-10 px-4 text-base": size === "md",
+      "h-12 px-6 text-lg": size === "lg",
+    },
+    // States
+    {
+      "opacity-50 cursor-not-allowed": disabled,
+    },
+    className,
+  );
+
+  // 7. Render
+  return (
+    <button
+      type="button"
+      className={classes}
+      onClick={handleClick}
+      disabled={disabled}
+      aria-disabled={disabled}
+    >
+      {children}
+    </button>
+  );
+}
+
+// 8. Sub-components (if needed)
+ComponentName.Slot = function ComponentNameSlot({
+  className,
+  children,
+}: ComponentNameProps) {
+  return (
+    <div className={cn("flex items-center gap-2", className)}>{children}</div>
+  );
+};
+
+// 9. Display Name (for debugging)
+ComponentName.displayName = "ComponentName";
diff --git a/.agents/skills/frontend-agent/resources/error-playbook.md b/.agents/skills/frontend-agent/resources/error-playbook.md
new file mode 100644
index 0000000..991f1e9
--- /dev/null
+++ b/.agents/skills/frontend-agent/resources/error-playbook.md
@@ -0,0 +1,108 @@
+# Frontend Agent - Error Recovery Playbook
+
+When you encounter a failure, find the matching scenario and follow the recovery steps.
+Do NOT stop or ask for help until you have exhausted the playbook.
+
+---
+
+## TypeScript Compilation Error
+
+**Symptoms**: `TS2322`, `TS2345`, `Type X is not assignable to type Y`
+
+1. Read the error — which file, which line, which types conflict
+2. Check: is the interface/type definition correct?
+3. Check: is the API response type matching the expected shape?
+4. If API mismatch: update the type to match actual response (don't cast with `as any`)
+5. If generic issue: use explicit type parameter `<Type>` instead of inference
+6. **NEVER do this**: `@ts-ignore`, `as any` — hides type issues without resolving them
+
+---
+
+## Build Error
+
+**Symptoms**: `next build` fails, `Module not found`, `SyntaxError`
+
+1. Read the full error — which module, which file
+2. If missing dependency: note in result as "requires `npm install X`" — do NOT install yourself
+3. If import path wrong: use `search_for_pattern("export.*ComponentName")` to find actual path
+4. If dynamic import issue: ensure component is client-side (`'use client'`)
+5. Re-run build after fix to confirm
+
+---
+
+## Test Failure
+
+**Symptoms**: `vitest` FAILED, `expect(X).toBe(Y)` assertion errors
+
+1. Read the error — expected vs received, which test file
+2. `find_symbol("ComponentName")` to check current implementation
+3. Determine: test outdated or implementation wrong?
+   - Test expects old behavior → update test
+   - Component bug → fix component
+4. Re-run the specific test: `npx vitest run path/to/test.ts`
+5. **After 3 failures**: Try a different approach. Record in progress
+
+---
+
+## Hydration Mismatch (Next.js)
+
+**Symptoms**: `Hydration failed`, `Text content does not match server-rendered HTML`
+
+1. Find the component that renders differently on server vs client
+2. Common causes:
+   - `Date.now()` or `Math.random()` in render
+   - Browser-only APIs (`window`, `localStorage`) without `useEffect`
+   - Conditional rendering based on client-only state
+3. Fix: wrap client-only code in `useEffect` + state, or use `'use client'`
+4. If third-party component: wrap with `dynamic(() => import(...), { ssr: false })`
+
+---
+
+## API Integration Error
+
+**Symptoms**: `Network Error`, `CORS`, `401 Unauthorized`, wrong data shape
+
+1. **CORS**: Check backend CORS config — is frontend origin allowed?
+2. **401**: Check token — is it in the header? is it expired?
+3. **Wrong data**: Log `response.data` and compare with expected type
+4. **Network Error**: Is the backend running? Correct port?
+5. If backend isn't your responsibility: document the expected API contract in result
+
+---
+
+## Styling / Layout Broken
+
+**Symptoms**: Component renders but looks wrong, responsive breakpoint fails
+
+1. Check Tailwind classes — typo? wrong breakpoint prefix?
+2. Check parent container — is it blocking layout? (`overflow-hidden`, fixed width)
+3. Test at specific breakpoints: 320px, 768px, 1024px, 1440px
+4. Use browser DevTools to inspect computed styles
+5. If dark mode issue: check `dark:` variants applied
+
+---
+
+## Rate Limit / Quota Error (Gemini API)
+
+**Symptoms**: `429`, `RESOURCE_EXHAUSTED`, `rate limit exceeded`
+
+1. **Stop immediately** — do not make additional API calls
+2. Save current work to `progress-{agent-id}.md`
+3. Record Status: `quota_exceeded` in `result-{agent-id}.md`
+4. Specify remaining tasks
+
+---
+
+## Serena Memory Unavailable
+
+1. Retry once
+2. If 2 consecutive failures: use local file `/tmp/progress-{agent-id}.md`
+3. Add `memory_fallback: true` flag to result
+
+---
+
+## General Principles
+
+- **After 3 failures**: If same approach fails 3 times, must try a different method
+- **Blocked**: If no progress after 5 turns, save current state and record `Status: blocked`
+- **Out of scope**: If you find backend issues, only record in result — do not modify directly
diff --git a/.agents/skills/frontend-agent/resources/examples.md b/.agents/skills/frontend-agent/resources/examples.md
new file mode 100644
index 0000000..2e262ef
--- /dev/null
+++ b/.agents/skills/frontend-agent/resources/examples.md
@@ -0,0 +1,77 @@
+# Frontend Agent - Examples
+
+## Example 1: Feature Component
+
+**Input**: "Create a todo list page with add, toggle, and delete"
+
+**Output**:
+```
+## Task: Todo List Page
+
+### Implementation
+- Components: TodoList, TodoItem, AddTodoForm
+- Routes: /todos (page)
+- State: TanStack Query for server state, local state for form
+
+### Files Created/Modified
+- src/types/todo.ts (NEW) - Todo interface
+- src/lib/api/todos.ts (NEW) - API client with TanStack Query hooks
+- src/components/todo/TodoItem.tsx (NEW) - Single todo display
+- src/components/todo/AddTodoForm.tsx (NEW) - Form with validation
+- src/components/todo/TodoList.tsx (NEW) - List container
+- src/app/todos/page.tsx (NEW) - Page component
+- tests/components/TodoList.test.tsx (NEW)
+
+### Testing
+- Unit tests: 5 passing
+- Keyboard navigation: verified
+- Responsive: tested at 4 breakpoints
+```
+
+## Example 2: Form with Validation
+
+**Input**: "Create a user profile edit form"
+
+**Output**:
+```
+## Task: Profile Edit Form
+
+### Implementation
+- Components: ProfileForm (React Hook Form + Zod)
+- Validation: name (required, 2-50 chars), email (valid format), bio (optional, max 500)
+- API: PATCH /api/users/me via TanStack Query mutation
+- UX: optimistic update, error toast, success redirect
+
+### Files Created
+- src/types/user.ts
+- src/lib/api/users.ts
+- src/components/profile/ProfileForm.tsx
+- src/app/profile/edit/page.tsx
+- tests/components/ProfileForm.test.tsx
+```
+
+## Example 3: Responsive Dashboard
+
+**Input**: "Build a dashboard with stats cards and a chart"
+
+**Output**:
+```
+## Task: Dashboard Page
+
+### Implementation
+- Components: StatCard, StatsGrid, ActivityChart
+- Layout: CSS Grid - 1 col (mobile), 2 col (tablet), 4 col (desktop)
+- Chart: recharts with responsive container
+- Data: TanStack Query with 30s refetch interval
+
+### Accessibility
+- [x] All cards have aria-label with stat value
+- [x] Chart has aria-describedby with text summary
+- [x] Color contrast 4.5:1 on all text
+
+### Files Created
+- src/components/dashboard/StatCard.tsx
+- src/components/dashboard/StatsGrid.tsx
+- src/components/dashboard/ActivityChart.tsx
+- src/app/dashboard/page.tsx
+```
diff --git a/.agents/skills/frontend-agent/resources/execution-protocol.md b/.agents/skills/frontend-agent/resources/execution-protocol.md
new file mode 100644
index 0000000..c5c1cca
--- /dev/null
+++ b/.agents/skills/frontend-agent/resources/execution-protocol.md
@@ -0,0 +1,49 @@
+# Frontend Agent - Execution Protocol
+
+## Step 0: Prepare
+1. **Assess difficulty** — see `../_shared/difficulty-guide.md`
+   - **Simple**: Skip to Step 3 | **Medium**: All 4 steps | **Complex**: All steps + checkpoints
+2. **Check lessons** — read your domain section in `../_shared/lessons-learned.md`
+3. **Clarify requirements** — follow `../_shared/clarification-protocol.md`
+   - Check **Uncertainty Triggers**: business logic, security/auth, existing code conflicts?
+   - Determine level: LOW → proceed | MEDIUM → present options | HIGH → ask immediately
+4. **Budget context** — follow `../_shared/context-budget.md` (read symbols, not whole files)
+
+**⚠️ Intelligent Escalation**: When uncertain, escalate early. Don't blindly proceed.
+
+Follow these steps in order (adjust depth by difficulty).
+
+## Step 1: Analyze
+- Read the task requirements carefully
+- Identify which components, pages, and hooks are needed
+- Check existing code with Serena: `get_symbols_overview("src/components")`, `find_symbol("ComponentName")`
+- Review existing patterns: `find_referencing_symbols("Button")` to understand usage conventions
+- List assumptions; ask if unclear
+
+## Step 2: Plan
+- Decide on component structure (which are new, which extend existing)
+- Define props interfaces with TypeScript
+- Plan state management approach (local state, Context, Zustand)
+- Identify API integration points (TanStack Query hooks)
+- Plan responsive breakpoints and accessibility requirements
+
+## Step 3: Implement
+- Create/modify files in this order:
+  1. TypeScript types/interfaces
+  2. API client hooks (TanStack Query)
+  3. Reusable UI components (shadcn/ui based)
+  4. Feature components (compose UI + logic)
+  5. Page components (route-level)
+  6. Tests (unit + integration)
+- Use `resources/component-template.tsx` as reference
+- Follow `resources/tailwind-rules.md` for styling
+
+## Step 4: Verify
+- Run `resources/checklist.md` items
+- Run `../_shared/common-checklist.md` items
+- Check TypeScript strict mode: no errors
+- Verify responsive design at 320px, 768px, 1024px, 1440px
+- Test keyboard navigation and screen reader compatibility
+
+## On Error
+See `resources/error-playbook.md` for recovery steps.
diff --git a/.agents/skills/frontend-agent/resources/snippets.md b/.agents/skills/frontend-agent/resources/snippets.md
new file mode 100644
index 0000000..10f9d02
--- /dev/null
+++ b/.agents/skills/frontend-agent/resources/snippets.md
@@ -0,0 +1,205 @@
+# Frontend Agent - Code Snippets
+
+Copy-paste ready patterns. Use these as starting points, adapt to the specific task.
+
+---
+
+## React Component with Props
+
+```tsx
+interface CardProps {
+  title: string;
+  description?: string;
+  onClick?: () => void;
+}
+
+export function Card({ title, description, onClick }: CardProps) {
+  return (
+    <button
+      onClick={onClick}
+      className="rounded-lg border bg-card p-4 text-left shadow-sm transition-colors hover:bg-accent"
+    >
+      <h3 className="text-lg font-semibold">{title}</h3>
+      {description && (
+        <p className="mt-1 text-sm text-muted-foreground">{description}</p>
+      )}
+    </button>
+  );
+}
+```
+
+---
+
+## TanStack Query Hook
+
+```tsx
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+
+interface Todo {
+  id: string;
+  title: string;
+  completed: boolean;
+}
+
+export function useTodos() {
+  return useQuery<Todo[]>({
+    queryKey: ["todos"],
+    queryFn: async () => {
+      const res = await fetch("/api/todos", {
+        headers: { Authorization: `Bearer ${getToken()}` },
+      });
+      if (!res.ok) throw new Error("Failed to fetch");
+      return res.json();
+    },
+  });
+}
+
+export function useCreateTodo() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async (data: { title: string }) => {
+      const res = await fetch("/api/todos", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${getToken()}`,
+        },
+        body: JSON.stringify(data),
+      });
+      if (!res.ok) throw new Error("Failed to create");
+      return res.json();
+    },
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: ["todos"] }),
+  });
+}
+```
+
+---
+
+## Form with React Hook Form + Zod
+
+```tsx
+"use client";
+
+import { useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+const schema = z.object({
+  email: z.string().email("Invalid email"),
+  password: z.string().min(8, "At least 8 characters"),
+});
+
+type FormData = z.infer<typeof schema>;
+
+export function LoginForm({ onSubmit }: { onSubmit: (data: FormData) => void }) {
+  const {
+    register,
+    handleSubmit,
+    formState: { errors, isSubmitting },
+  } = useForm<FormData>({ resolver: zodResolver(schema) });
+
+  return (
+    <form onSubmit={handleSubmit(onSubmit)} className="space-y-4">
+      <div>
+        <label htmlFor="email" className="text-sm font-medium">
+          Email
+        </label>
+        <input
+          id="email"
+          type="email"
+          {...register("email")}
+          className="mt-1 w-full rounded-md border px-3 py-2"
+          aria-invalid={!!errors.email}
+        />
+        {errors.email && (
+          <p className="mt-1 text-sm text-destructive">{errors.email.message}</p>
+        )}
+      </div>
+      <div>
+        <label htmlFor="password" className="text-sm font-medium">
+          Password
+        </label>
+        <input
+          id="password"
+          type="password"
+          {...register("password")}
+          className="mt-1 w-full rounded-md border px-3 py-2"
+          aria-invalid={!!errors.password}
+        />
+        {errors.password && (
+          <p className="mt-1 text-sm text-destructive">{errors.password.message}</p>
+        )}
+      </div>
+      <button
+        type="submit"
+        disabled={isSubmitting}
+        className="w-full rounded-md bg-primary px-4 py-2 text-primary-foreground disabled:opacity-50"
+      >
+        {isSubmitting ? "Signing in..." : "Sign in"}
+      </button>
+    </form>
+  );
+}
+```
+
+---
+
+## Loading / Error / Empty States
+
+```tsx
+interface AsyncStateProps<T> {
+  data: T | undefined;
+  isLoading: boolean;
+  error: Error | null;
+  empty: React.ReactNode;
+  children: (data: T) => React.ReactNode;
+}
+
+export function AsyncState<T>({ data, isLoading, error, empty, children }: AsyncStateProps<T>) {
+  if (isLoading) return <div className="flex justify-center p-8"><Spinner /></div>;
+  if (error) return <ErrorCard message={error.message} />;
+  if (!data || (Array.isArray(data) && data.length === 0)) return <>{empty}</>;
+  return <>{children(data)}</>;
+}
+```
+
+---
+
+## Responsive Grid Layout
+
+```tsx
+export function StatsGrid({ children }: { children: React.ReactNode }) {
+  return (
+    <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-4">
+      {children}
+    </div>
+  );
+}
+```
+
+---
+
+## Vitest Component Test
+
+```tsx
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, it, expect, vi } from "vitest";
+import { Card } from "./Card";
+
+describe("Card", () => {
+  it("renders title and description", () => {
+    render(<Card title="Test" description="Desc" />);
+    expect(screen.getByText("Test")).toBeInTheDocument();
+    expect(screen.getByText("Desc")).toBeInTheDocument();
+  });
+
+  it("calls onClick when clicked", async () => {
+    const onClick = vi.fn();
+    render(<Card title="Test" onClick={onClick} />);
+    await userEvent.click(screen.getByText("Test"));
+    expect(onClick).toHaveBeenCalledOnce();
+  });
+});
+```
diff --git a/.agents/skills/frontend-agent/resources/tailwind-rules.md b/.agents/skills/frontend-agent/resources/tailwind-rules.md
new file mode 100644
index 0000000..603be17
--- /dev/null
+++ b/.agents/skills/frontend-agent/resources/tailwind-rules.md
@@ -0,0 +1,343 @@
+# Tailwind CSS Best Practices
+
+## Core Principles
+
+1. **NO inline styles** - Always use Tailwind classes
+2. **Responsive-first** - Design for mobile, scale up
+3. **Consistent spacing** - Use Tailwind's spacing scale
+4. **Dark mode support** - Use `dark:` variant
+
+## Spacing Scale
+
+Use Tailwind's consistent scale:
+
+```tsx
+// ✅ GOOD
+<div className="p-4 mb-6 gap-2">
+
+// ❌ BAD - arbitrary values without reason
+<div className="p-[17px] mb-[23px]">
+```
+
+Standard scale:
+- `1` = 0.25rem (4px)
+- `2` = 0.5rem (8px)
+- `4` = 1rem (16px)
+- `6` = 1.5rem (24px)
+- `8` = 2rem (32px)
+
+## Responsive Design
+
+Mobile-first approach:
+
+```tsx
+// ✅ GOOD - Mobile first, then scale up
+<div className="
+  grid grid-cols-1
+  sm:grid-cols-2
+  lg:grid-cols-3
+  gap-4
+">
+
+// ❌ BAD - Desktop first
+<div className="grid-cols-3 sm:grid-cols-1">
+```
+
+Breakpoints:
+- `sm`: 640px
+- `md`: 768px
+- `lg`: 1024px
+- `xl`: 1280px
+- `2xl`: 1536px
+
+## Color System
+
+Use semantic color tokens:
+
+```tsx
+// ✅ GOOD - Semantic tokens
+<div className="bg-background text-foreground border-border">
+<button className="bg-primary text-primary-foreground">
+
+// ❌ BAD - Hardcoded colors
+<div className="bg-white text-black border-gray-300">
+```
+
+Semantic tokens:
+- `background` / `foreground`
+- `primary` / `primary-foreground`
+- `secondary` / `secondary-foreground`
+- `muted` / `muted-foreground`
+- `accent` / `accent-foreground`
+- `destructive` / `destructive-foreground`
+- `border` / `input` / `ring`
+
+## Dark Mode
+
+Always support dark mode:
+
+```tsx
+// ✅ GOOD
+<div className="
+  bg-white dark:bg-gray-900
+  text-gray-900 dark:text-gray-100
+  border-gray-200 dark:border-gray-800
+">
+
+// ❌ BAD - No dark mode
+<div className="bg-white text-black">
+```
+
+## Layout
+
+### Flexbox
+```tsx
+// Horizontal layout
+<div className="flex items-center gap-4">
+
+// Vertical layout
+<div className="flex flex-col gap-2">
+
+// Centered content
+<div className="flex items-center justify-center min-h-screen">
+```
+
+### Grid
+```tsx
+// Auto-fit columns
+<div className="grid grid-cols-[repeat(auto-fit,minmax(300px,1fr))] gap-4">
+
+// Responsive grid
+<div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">
+```
+
+## Typography
+
+```tsx
+// Headings
+<h1 className="text-4xl font-bold tracking-tight">
+<h2 className="text-3xl font-semibold">
+<h3 className="text-2xl font-semibold">
+
+// Body text
+<p className="text-base leading-7">
+<p className="text-sm text-muted-foreground">
+
+// Links
+<a className="text-primary hover:underline">
+```
+
+## Interactive Elements
+
+### Buttons
+```tsx
+// Primary button
+<button className="
+  inline-flex items-center justify-center
+  rounded-md px-4 py-2
+  bg-primary text-primary-foreground
+  hover:bg-primary/90
+  disabled:opacity-50 disabled:pointer-events-none
+  transition-colors
+">
+
+// Ghost button
+<button className="
+  hover:bg-accent hover:text-accent-foreground
+  transition-colors
+">
+```
+
+### Inputs
+```tsx
+<input className="
+  flex h-10 w-full rounded-md border border-input
+  bg-background px-3 py-2
+  text-sm
+  placeholder:text-muted-foreground
+  focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring
+  disabled:cursor-not-allowed disabled:opacity-50
+" />
+```
+
+## Animations
+
+Use Tailwind's transition utilities:
+
+```tsx
+// Color transitions
+<div className="transition-colors hover:bg-accent">
+
+// Multiple properties
+<div className="transition-all duration-200 hover:scale-105">
+
+// Custom animations
+<div className="animate-pulse">
+<div className="animate-spin">
+<div className="animate-bounce">
+```
+
+## Accessibility
+
+### Focus States
+```tsx
+// Always include focus styles
+<button className="
+  focus:outline-none
+  focus-visible:ring-2
+  focus-visible:ring-ring
+  focus-visible:ring-offset-2
+">
+```
+
+### Screen Reader Only
+```tsx
+<span className="sr-only">Hidden text for screen readers</span>
+```
+
+## Common Patterns
+
+### Card
+```tsx
+<div className="rounded-lg border bg-card p-6 shadow-sm">
+  <h3 className="text-2xl font-semibold mb-2">Title</h3>
+  <p className="text-muted-foreground">Description</p>
+</div>
+```
+
+### Modal Overlay
+```tsx
+<div className="fixed inset-0 z-50 bg-black/80">
+  <div className="fixed left-1/2 top-1/2 -translate-x-1/2 -translate-y-1/2">
+    {/* Modal content */}
+  </div>
+</div>
+```
+
+### Loading State
+```tsx
+<div className="flex items-center justify-center p-8">
+  <div className="h-8 w-8 animate-spin rounded-full border-4 border-primary border-t-transparent" />
+</div>
+```
+
+### Skeleton
+```tsx
+<div className="space-y-2">
+  <div className="h-4 w-full bg-muted animate-pulse rounded" />
+  <div className="h-4 w-3/4 bg-muted animate-pulse rounded" />
+</div>
+```
+
+## cn() Utility
+
+Use `cn()` for conditional classes:
+
+```tsx
+import { cn } from '@/lib/utils';
+
+// Merge classes with conditions
+<div className={cn(
+  'base-class',
+  condition && 'conditional-class',
+  {
+    'variant-a': variant === 'a',
+    'variant-b': variant === 'b',
+  },
+  className // Allow prop overrides
+)} />
+```
+
+## Arbitrary Values
+
+Only use when absolutely necessary:
+
+```tsx
+// ✅ GOOD - Use standard values
+<div className="w-64 h-64">
+
+// ⚠️ OK - Special case
+<div className="w-[789px]"> // Specific design requirement
+
+// ❌ BAD - Should use standard value
+<div className="w-[250px]"> // Just use w-64 (256px)
+```
+
+## Custom Utilities
+
+Add to `tailwind.config.js`:
+
+```js
+module.exports = {
+  theme: {
+    extend: {
+      spacing: {
+        '18': '4.5rem', // Custom spacing
+      },
+      colors: {
+        brand: {
+          50: '#...',
+          // ...
+          900: '#...',
+        },
+      },
+    },
+  },
+};
+```
+
+## Performance
+
+### Purging
+Tailwind auto-purges unused classes in production.
+
+### JIT Mode
+Enabled by default in Tailwind 3+.
+
+### Avoid @apply
+Prefer utility classes in JSX over `@apply` in CSS:
+
+```tsx
+// ✅ GOOD
+<button className="px-4 py-2 bg-primary text-white rounded">
+
+// ❌ BAD
+// In CSS: .btn { @apply px-4 py-2 bg-primary text-white rounded; }
+<button className="btn">
+```
+
+## Linting
+
+Use Prettier plugin for class sorting:
+
+```bash
+npm install -D prettier prettier-plugin-tailwindcss
+```
+
+`.prettierrc`:
+```json
+{
+  "plugins": ["prettier-plugin-tailwindcss"]
+}
+```
+
+Classes will auto-sort:
+```tsx
+// Before
+<div className="text-white p-4 bg-blue-500 rounded">
+
+// After (auto-sorted)
+<div className="rounded bg-blue-500 p-4 text-white">
+```
+
+## Checklist
+
+- [ ] No inline styles used
+- [ ] Responsive design (mobile-first)
+- [ ] Dark mode support (`dark:` variants)
+- [ ] Semantic color tokens used
+- [ ] Consistent spacing scale
+- [ ] Focus states for interactive elements
+- [ ] Hover states with transitions
+- [ ] Loading/skeleton states
+- [ ] Classes sorted (with Prettier plugin)
diff --git a/.agents/skills/frontend-agent/resources/tech-stack.md b/.agents/skills/frontend-agent/resources/tech-stack.md
new file mode 100644
index 0000000..75dcf6b
--- /dev/null
+++ b/.agents/skills/frontend-agent/resources/tech-stack.md
@@ -0,0 +1,36 @@
+# Frontend Agent - Tech Stack Reference
+
+## Core Stack
+- **Framework**: Next.js 14+ (App Router), React 18+
+- **Language**: TypeScript (strict mode)
+- **Styling**: Tailwind CSS 3+ (NO inline styles)
+- **Components**: shadcn/ui, Radix UI
+- **State**: React Context, Zustand, or Redux Toolkit
+- **Forms**: React Hook Form + Zod
+- **API Client**: TanStack Query
+- **Testing**: Vitest, React Testing Library, Playwright
+
+## Code Standards
+- Explicit TypeScript interfaces for props
+- Tailwind classes only (no inline styles)
+- Semantic HTML with ARIA labels
+- Keyboard navigation support
+
+## Project Structure
+
+```
+src/
+  app/           # Next.js App Router pages
+  components/
+    ui/          # Reusable primitives (button, card)
+    [feature]/   # Feature components
+  lib/
+    api/         # API clients (TanStack Query hooks)
+    hooks/       # Custom hooks
+  types/         # TypeScript types
+```
+
+## Serena MCP Shortcuts
+- `find_symbol("ComponentName")`: Locate existing component
+- `get_symbols_overview("src/components")`: List all components
+- `find_referencing_symbols("Button")`: Find usages before changes
diff --git a/.agents/skills/frontend-engineer/SKILL.md b/.agents/skills/frontend-engineer/SKILL.md
deleted file mode 100644
index 56bc2df..0000000
--- a/.agents/skills/frontend-engineer/SKILL.md
+++ /dev/null
@@ -1,81 +0,0 @@
----
-name: frontend-engineer
-description: Develop production-grade frontend code using shadcn/ui, best practices, and strict design alignment.
----
-
-Guidelines for maintainable, accessible, and system-compliant frontend development.
-
-# Core Principles
-
-1. **Component Reuse**: Use `shadcn/ui` components first. Extend via `cva` variants or composition. Avoid custom CSS.
-2. **Design Fidelity**: Code must map 1:1 to Design Tokens. Resolve discrepancies before implementation.
-3. **Rendering Strategy**: Default to Server Components for performance. Use Client Components only for interactivity and API integration.
-4. **Accessibility**: Semantic HTML and screen reader compatibility are mandatory.
-5. **Tool First**: Check for existing solutions and tools before coding.
-
-# 1. Tooling & Performance
-
-- **Reference**: Consult `react-best-practices` skill for deep dives.
-- **Metrics**: Target First Contentful Paint (FCP) < 1s.
-- **Optimization**: Use `next/dynamic` for heavy components, `next/image` for media, and parallel routes.
-- **Shadcn Workflow**:
-    1. Search: `shadcn_search_items_in_registries`
-    2. Review: `shadcn_get_item_examples_from_registries`
-    3. Install: `shadcn_get_add_command_for_items`
-
-# 2. Architecture (FSD-lite)
-
-- **Root (`src/`)**: Shared logic (components, lib, types). Hoist common code here.
-- **Feature (`src/features/*/`)**: Feature-specific logic. **No cross-feature imports.** Unidirectional flow only.
-- **Libraries**:
-  - Date: `luxon`
-  - Styling: `TailwindCSS v4` + `shadcn/ui`
-  - Hooks: `ahooks` (Pre-made hooks preferred)
-  - Utils: `es-toolkit` (First choice)
-
-# 3. Standards
-
-- **Utilities**: Check `es-toolkit` first. If implementing custom logic, **>90% Unit Test Coverage** is MANDATORY.
-- **Design Tokens**: Source of Truth is `packages/design-tokens` (OKLCH). Never hardcode colors. Run `mise tokens:build` after updates.
-- **i18n**: Source of Truth is `packages/i18n`. Never hardcode strings. Run `mise i18n:build` after updates.
-
-# 4. Component Strategy
-
-- **Server Components**: Use for Layouts, Marketing pages, and SEO metadata (`generateMetadata`, `sitemap`).
-- **Client Components**: Use for interactive features and `useQuery` (Orval) hooks.
-- **Structure**: **One Component Per File**.
-- **Naming**:
-  - Files: `kebab-case.tsx` (Name MUST clearly indicate purpose/functionality).
-  - Components/Types/Interfaces: `PascalCase`
-  - Functions/Vars/Hooks: `camelCase`
-  - Constants: `SCREAMING_SNAKE_CASE`
-- **Skeletons**: Must be placed in `src/features/[feature]/components/skeleton/`.
-- **Imports**: Standard > 3rd Party > Local (Absolute `@/` is MANDATORY; No relative paths like `../../`). **MUST use `import type`** for interfaces/types.
-- **State Management**:
-  - URL: `jotai-location`
-  - Server: `TanStack Query`
-  - Client Global: `Jotai` (Minimize use)
-  - Forms: `@tanstack/react-form` + `zod` (Refer to v4 docs; NO deprecated APIs)
-
-# 5. UI Implementation (Shadcn/UI)
-
-- **Patterns**: Review `.agent/skills/frontend-engineer/examples/` for mandated implementation patterns.
-- **Usage**: Prefer strict shadcn primitives (`Card`, `Sheet`, `Typography`, `Table`) over `div` or generic classes.
-- **Responsiveness**: Use `Drawer` (Mobile) vs `Dialog` (Desktop) via `useResponsive`.
-- **Customization Rule**: Treat `components/ui/*` as read-only. Do not modify directly.
-  - **Correct**: create a wrapper (e.g., `components/common/ProductButton.tsx`) or use `cva` composition.
-  - **Incorrect**: Editing `components/ui/button.tsx`.
-
-# 6. Designer Collaboration
-
-- **Sync**: Map code variables to Figma layer names.
-- **UX**: Ensure key actions are visible "Above the Fold". Verify clarity of usage.
-
-# 7. Review Checklist
-
-- [ ] **A11y**: Interactive elements have `aria-label`. Semantic headings (`h1`-`h6`).
-- [ ] **Mobile**: functionality verified on mobile viewports.
-- [ ] **Performance**: No CLS, fast load.
-- [ ] **Resilience**: Error Boundaries and Loading Skeletons implemented.
-- [ ] **Tests**: Logic covered by Vitest where complex.
-- [ ] **Quality**: Refactor until Typecheck and Lint (`bun lint`) pass.
diff --git a/.agents/skills/frontend-engineer/examples/data-table-usage.md b/.agents/skills/frontend-engineer/examples/data-table-usage.md
deleted file mode 100644
index 4c3143b..0000000
--- a/.agents/skills/frontend-engineer/examples/data-table-usage.md
+++ /dev/null
@@ -1,89 +0,0 @@
-# Data Table Pattern
-
-Standard `TanStack Table` implementation using `shadcn/ui`.
-**Key Rule**: Separate columns and data. Do not hardcode columns inside the component.
-
-## `src/features/[feature]/components/data-table.tsx`
-
-```tsx
-"use client";
-
-import {
-  ColumnDef,
-  flexRender,
-  getCoreRowModel,
-  useReactTable,
-} from "@tanstack/react-table";
-
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from "@/components/ui/table";
-
-interface DataTableProps<TData, TValue> {
-  columns: ColumnDef<TData, TValue>[];
-  data: TData[];
-}
-
-export function DataTable<TData, TValue>({
-  columns,
-  data,
-}: DataTableProps<TData, TValue>) {
-  const table = useReactTable({
-    data,
-    columns,
-    getCoreRowModel: getCoreRowModel(),
-  });
-
-  return (
-    <div className="rounded-md border">
-      <Table>
-        <TableHeader>
-          {table.getHeaderGroups().map((headerGroup) => (
-            <TableRow key={headerGroup.id}>
-              {headerGroup.headers.map((header) => {
-                return (
-                  <TableHead key={header.id}>
-                    {header.isPlaceholder
-                      ? null
-                      : flexRender(
-                          header.column.columnDef.header,
-                          header.getContext()
-                        )}
-                  </TableHead>
-                );
-              })}
-            </TableRow>
-          ))}
-        </TableHeader>
-        <TableBody>
-          {table.getRowModel().rows?.length ? (
-            table.getRowModel().rows.map((row) => (
-              <TableRow
-                key={row.id}
-                data-state={row.getIsSelected() && "selected"}
-              >
-                {row.getVisibleCells().map((cell) => (
-                  <TableCell key={cell.id}>
-                    {flexRender(cell.column.columnDef.cell, cell.getContext())}
-                  </TableCell>
-                ))}
-              </TableRow>
-            ))
-          ) : (
-            <TableRow>
-              <TableCell colSpan={columns.length} className="h-24 text-center">
-                No results.
-              </TableCell>
-            </TableRow>
-          )}
-        </TableBody>
-      </Table>
-    </div>
-  );
-}
-```
diff --git a/.agents/skills/frontend-engineer/examples/product-button.md b/.agents/skills/frontend-engineer/examples/product-button.md
deleted file mode 100644
index 0ec070c..0000000
--- a/.agents/skills/frontend-engineer/examples/product-button.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Product Button Pattern
-
-Wrapper pattern for `shadcn/ui` components.
-**Key Rule**: Do NOT modify `components/ui/button.tsx`. Create a wrapper for custom logic (loading state, specific branding).
-
-## `src/components/common/product-button.tsx`
-
-```tsx
-import { Button, type ButtonProps } from "@/components/ui/button";
-import { cn } from "@/lib/utils";
-import { Loader2 } from "lucide-react";
-
-interface ProductButtonProps extends ButtonProps {
-  isLoading?: boolean;
-}
-
-export function ProductButton({
-  children,
-  className,
-  isLoading,
-  disabled,
-  ...props
-}: ProductButtonProps) {
-  return (
-    <Button
-      disabled={disabled || isLoading}
-      className={cn("font-semibold", className)}
-      {...props}
-    >
-      {isLoading && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
-      {children}
-    </Button>
-  );
-}
-```
diff --git a/.agents/skills/mobile-agent/SKILL.md b/.agents/skills/mobile-agent/SKILL.md
new file mode 100644
index 0000000..cec7cc9
--- /dev/null
+++ b/.agents/skills/mobile-agent/SKILL.md
@@ -0,0 +1,48 @@
+---
+name: mobile-agent
+description: Mobile specialist for Flutter, React Native, and cross-platform mobile development. Use for mobile app, Flutter, Dart, iOS, Android, Riverpod, and widget work.
+---
+
+# Mobile Agent - Cross-Platform Mobile Specialist
+
+## When to use
+- Building native mobile applications (iOS + Android)
+- Mobile-specific UI patterns
+- Platform features (camera, GPS, push notifications)
+- Offline-first architecture
+
+## When NOT to use
+- Web frontend -> use Frontend Agent
+- Backend APIs -> use Backend Agent
+
+## Core Rules
+1. Clean Architecture: domain -> data -> presentation
+2. Riverpod/Bloc for state management (no raw setState for complex logic)
+3. Material Design 3 (Android) + iOS HIG (iOS)
+4. All controllers disposed in `dispose()` method
+5. Dio with interceptors for API calls; handle offline gracefully
+6. 60fps target; test on both platforms
+
+## How to Execute
+Follow `resources/execution-protocol.md` step by step.
+See `resources/examples.md` for input/output examples.
+Before submitting, run `resources/checklist.md`.
+
+## Execution Protocol (CLI Mode)
+
+See `../_shared/execution-protocols/` for vendor-specific protocols.
+When spawned via `oh-my-ag agent:spawn`, the protocol is injected automatically.
+
+## References
+- Execution steps: `resources/execution-protocol.md`
+- Code examples: `resources/examples.md`
+- Code snippets: `resources/snippets.md`
+- Checklist: `resources/checklist.md`
+- Error recovery: `resources/error-playbook.md`
+- Tech stack: `resources/tech-stack.md`
+- Screen template: `resources/screen-template.dart`
+- Context loading: `../_shared/context-loading.md`
+- Reasoning templates: `../_shared/reasoning-templates.md`
+- Clarification: `../_shared/clarification-protocol.md`
+- Context budget: `../_shared/context-budget.md`
+- Lessons learned: `../_shared/lessons-learned.md`
diff --git a/.agents/skills/mobile-agent/resources/checklist.md b/.agents/skills/mobile-agent/resources/checklist.md
new file mode 100644
index 0000000..12a7e7e
--- /dev/null
+++ b/.agents/skills/mobile-agent/resources/checklist.md
@@ -0,0 +1,35 @@
+# Mobile Agent - Self-Verification Checklist
+
+Run through every item before submitting your work.
+
+## Architecture
+- [ ] Clean Architecture layers: domain -> data -> presentation
+- [ ] Entities are pure Dart (no framework dependencies)
+- [ ] Repository pattern with interface + implementation
+- [ ] Riverpod/Bloc for state management (no setState in complex widgets)
+
+## Platform
+- [ ] Material Design 3 for Android
+- [ ] iOS Human Interface Guidelines followed
+- [ ] Platform-specific code guarded with `Platform.isIOS`/`Platform.isAndroid`
+- [ ] Tested on both iOS and Android (emulator or device)
+- [ ] Dark mode supported
+
+## Performance
+- [ ] 60fps scrolling (no jank)
+- [ ] Controllers disposed in `dispose()` method
+- [ ] No memory leaks (listeners, subscriptions cleaned up)
+- [ ] Images cached and sized appropriately
+- [ ] Cold start < 2s
+
+## API Integration
+- [ ] Dio with interceptors (auth, error handling)
+- [ ] Loading states shown during API calls
+- [ ] Error states with retry action
+- [ ] Offline handling (graceful degradation or offline-first)
+
+## Testing
+- [ ] Unit tests for domain logic and providers
+- [ ] Widget tests for key screens
+- [ ] Edge cases: empty lists, error states, offline mode
+- [ ] Tests pass on both platforms
diff --git a/.agents/skills/mobile-agent/resources/error-playbook.md b/.agents/skills/mobile-agent/resources/error-playbook.md
new file mode 100644
index 0000000..8a06034
--- /dev/null
+++ b/.agents/skills/mobile-agent/resources/error-playbook.md
@@ -0,0 +1,106 @@
+# Mobile Agent - Error Recovery Playbook
+
+When you encounter a failure, find the matching scenario and follow the recovery steps.
+Do NOT stop or ask for help until you have exhausted the playbook.
+
+---
+
+## Dart Analysis Error
+
+**Symptoms**: `flutter analyze` errors, type mismatch, null safety issues
+
+1. Read the error — file, line, expected type vs actual
+2. Null safety issue: add `?` for nullable, `!` only if you're certain it's non-null
+3. Type mismatch: check the model class — does it match the API response?
+4. Missing override: add `@override` annotation
+5. **NEVER do this**: `// ignore:` comments to suppress analysis warnings
+
+---
+
+## Build Failure
+
+**Symptoms**: `flutter build` fails, Gradle/Xcode errors
+
+1. **Gradle (Android)**:
+   - `Could not resolve`: dependency version conflict → check `pubspec.yaml`
+   - `minSdkVersion`: update `android/app/build.gradle` minimum SDK
+2. **Xcode (iOS)**:
+   - `Pod install` failure: note in result — may need `pod repo update`
+   - Minimum deployment target: check `ios/Podfile`
+3. Clean and retry: `flutter clean && flutter pub get`
+4. If persists: note in result with full error — may be environment issue
+
+---
+
+## Test Failure
+
+**Symptoms**: `flutter test` FAILED, widget test assertion errors
+
+1. Read the error — which test, which widget, expected vs actual
+2. Widget test: check if `pumpAndSettle()` is needed (async operations)
+3. Provider not found: wrap test widget with `ProviderScope` (Riverpod)
+4. Mock missing: ensure all dependencies are mocked
+5. Re-run specific test: `flutter test test/path/to_test.dart`
+6. **After 3 failures**: Try a different approach
+
+---
+
+## State Management Issue
+
+**Symptoms**: UI not updating, stale state, provider errors
+
+1. **Riverpod**: Check provider type — `StateNotifierProvider` vs `FutureProvider` vs `AsyncNotifierProvider`
+2. Is the widget watching correctly? (`ref.watch` not `ref.read` for UI)
+3. Is the state being mutated instead of replaced? (create new state object)
+4. Add debug print in provider to trace state changes
+5. Check: is `dispose` being called prematurely?
+
+---
+
+## Platform-Specific Crash
+
+**Symptoms**: Works on one platform, crashes on another
+
+1. Check for `Platform.isIOS` / `Platform.isAndroid` guards
+2. Check permissions: camera, location, storage — different per platform
+3. Check native plugin compatibility — some plugins don't support both platforms
+4. If plugin issue: note in result with platform and version info
+5. Test on emulator for the failing platform
+
+---
+
+## Memory Leak
+
+**Symptoms**: App slows down over time, `flutter run` shows increasing memory
+
+1. Check: are all controllers disposed? (`TextEditingController`, `AnimationController`)
+2. Check: are streams closed? (`StreamSubscription.cancel()`)
+3. Check: are listeners removed? (`removeListener` in `dispose`)
+4. Check: are `Timer` / `Timer.periodic` cancelled?
+5. Use `DevTools` memory tab to identify leak source
+
+---
+
+## API Integration Error
+
+**Symptoms**: Dio errors, `DioException`, wrong response parsing
+
+1. **Connection refused**: backend running? correct URL/port?
+2. **401**: auth interceptor sending token? token expired?
+3. **Parse error**: `response.data` shape doesn't match model → log raw response
+4. **Timeout**: increase Dio timeout or check network conditions
+5. If backend issue: document expected contract in result
+
+---
+
+## Rate Limit / Quota / Memory Fallback
+
+Same as backend-agent playbook: See "Rate Limit" and "Serena Memory" sections.
+
+---
+
+## General Principles
+
+- **After 3 failures**: If same approach fails 3 times, must try a different method
+- **Blocked**: If no progress after 5 turns, save current state, `Status: blocked`
+- **Out of scope**: Backend/frontend issues — only record in result
diff --git a/.agents/skills/mobile-agent/resources/examples.md b/.agents/skills/mobile-agent/resources/examples.md
new file mode 100644
index 0000000..34bb074
--- /dev/null
+++ b/.agents/skills/mobile-agent/resources/examples.md
@@ -0,0 +1,79 @@
+# Mobile Agent - Examples
+
+## Example 1: List Screen with CRUD
+
+**Input**: "Create a todo list screen with add, toggle, and swipe-to-delete"
+
+**Output**:
+```
+## Task: Todo List Screen
+
+### Implementation
+- Screens: TodoListScreen, AddTodoSheet (bottom sheet)
+- State: Riverpod with AsyncNotifier for todo list
+- API: Dio with auth interceptor -> /api/todos
+
+### Platform Support
+- [x] iOS (14.0+) - Cupertino swipe actions
+- [x] Android (API 24+) - Material Dismissible
+- [x] Dark mode
+
+### Files Created
+- lib/features/todo/domain/entities/todo.dart
+- lib/features/todo/domain/repositories/todo_repository.dart
+- lib/features/todo/data/models/todo_model.dart
+- lib/features/todo/data/repositories/todo_repository_impl.dart
+- lib/features/todo/presentation/providers/todo_provider.dart
+- lib/features/todo/presentation/screens/todo_list_screen.dart
+- lib/features/todo/presentation/widgets/todo_item.dart
+- test/features/todo/todo_provider_test.dart
+- test/features/todo/todo_list_screen_test.dart
+```
+
+## Example 2: Authentication Flow
+
+**Input**: "Create login and register screens with JWT auth"
+
+**Output**:
+```
+## Task: Authentication Screens
+
+### Implementation
+- Screens: LoginScreen, RegisterScreen
+- State: Riverpod AuthNotifier (token storage via flutter_secure_storage)
+- Navigation: GoRouter redirect guard for unauthenticated users
+- Validation: Form validation for email + password
+
+### Files Created
+- lib/core/auth/auth_provider.dart
+- lib/core/auth/auth_interceptor.dart (Dio interceptor)
+- lib/features/auth/presentation/screens/login_screen.dart
+- lib/features/auth/presentation/screens/register_screen.dart
+- lib/features/auth/presentation/widgets/auth_form.dart
+- test/core/auth/auth_provider_test.dart
+```
+
+## Example 3: Offline-First Feature
+
+**Input**: "Make the notes feature work offline with sync"
+
+**Output**:
+```
+## Task: Offline Notes with Sync
+
+### Implementation
+- Local DB: Drift (SQLite) for offline storage
+- Sync: Queue-based sync on connectivity change
+- UI: Sync status indicator (synced/pending/error)
+
+### Architecture
+- NoteLocalDataSource (Drift) + NoteRemoteDataSource (Dio)
+- NoteRepository merges local + remote with conflict resolution
+- ConnectivityProvider triggers sync on reconnect
+
+### Files Created
+- lib/features/notes/data/local/note_dao.dart
+- lib/features/notes/data/local/note_database.dart
+- lib/features/notes/data/repositories/note_sync_repository.dart
+- lib/core/sync/sync_queue.dart
+```
diff --git a/.agents/skills/mobile-agent/resources/execution-protocol.md b/.agents/skills/mobile-agent/resources/execution-protocol.md
new file mode 100644
index 0000000..b078805
--- /dev/null
+++ b/.agents/skills/mobile-agent/resources/execution-protocol.md
@@ -0,0 +1,49 @@
+# Mobile Agent - Execution Protocol
+
+## Step 0: Prepare
+1. **Assess difficulty** — see `../_shared/difficulty-guide.md`
+   - **Simple**: Skip to Step 3 | **Medium**: All 4 steps | **Complex**: All steps + checkpoints
+2. **Check lessons** — read your domain section in `../_shared/lessons-learned.md`
+3. **Clarify requirements** — follow `../_shared/clarification-protocol.md`
+   - Check **Uncertainty Triggers**: business logic, security/auth, existing code conflicts?
+   - Determine level: LOW → proceed | MEDIUM → present options | HIGH → ask immediately
+4. **Budget context** — follow `../_shared/context-budget.md` (read symbols, not whole files)
+
+**⚠️ Intelligent Escalation**: When uncertain, escalate early. Don't blindly proceed.
+
+Follow these steps in order (adjust depth by difficulty).
+
+## Step 1: Analyze
+- Read the task requirements carefully
+- Identify which screens, widgets, and providers are needed
+- Check existing code with Serena: `get_symbols_overview("lib/features")`, `find_symbol("ScreenName")`
+- Determine platform-specific requirements (iOS vs Android)
+- List assumptions; ask if unclear
+
+## Step 2: Plan
+- Decide on feature structure using Clean Architecture
+- Define entities (domain) and repository interfaces
+- Plan state management (Riverpod providers)
+- Identify navigation routes (GoRouter)
+- Plan offline-first strategy if required
+- Note platform differences (Material Design 3 vs iOS HIG)
+
+## Step 3: Implement
+- Create/modify files in this order:
+  1. Domain: entities and repository interfaces
+  2. Data: models, API clients (Dio), repository implementations
+  3. Presentation: providers (Riverpod), screens, widgets
+  4. Navigation: GoRouter routes
+  5. Tests: unit + widget tests
+- Use `resources/screen-template.dart` as reference
+- Follow Clean Architecture layers strictly
+
+## Step 4: Verify
+- Run `resources/checklist.md` items
+- Run `../_shared/common-checklist.md` items
+- Test on both iOS and Android (or emulators)
+- Verify 60fps performance (no jank)
+- Check dark mode support
+
+## On Error
+See `resources/error-playbook.md` for recovery steps.
diff --git a/.agents/skills/mobile-agent/resources/screen-template.dart b/.agents/skills/mobile-agent/resources/screen-template.dart
new file mode 100644
index 0000000..12da08b
--- /dev/null
+++ b/.agents/skills/mobile-agent/resources/screen-template.dart
@@ -0,0 +1,298 @@
+/**
+ * Screen Template for Mobile Agent (Flutter)
+ *
+ * This template demonstrates best practices for Flutter screens.
+ */
+
+import 'package:flutter/material.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+
+// Provider definition (in separate file: providers/example_providers.dart)
+/*
+final exampleProvider = FutureProvider<List<ExampleModel>>((ref) async {
+  final repository = ref.watch(exampleRepositoryProvider);
+  return repository.fetchData();
+});
+*/
+
+/// Example screen demonstrating common patterns
+class ExampleScreen extends ConsumerStatefulWidget {
+  /// Route name for navigation
+  static const routeName = '/example';
+
+  /// Constructor
+  const ExampleScreen({super.key});
+
+  @override
+  ConsumerState<ExampleScreen> createState() => _ExampleScreenState();
+}
+
+class _ExampleScreenState extends ConsumerState<ExampleScreen> {
+  // Local state (if needed)
+  final _scrollController = ScrollController();
+  bool _showScrollToTop = false;
+
+  @override
+  void initState() {
+    super.initState();
+    _setupScrollListener();
+  }
+
+  @override
+  void dispose() {
+    _scrollController.dispose();
+    super.dispose();
+  }
+
+  void _setupScrollListener() {
+    _scrollController.addListener(() {
+      final shouldShow = _scrollController.offset > 200;
+      if (shouldShow != _showScrollToTop) {
+        setState(() => _showScrollToTop = shouldShow);
+      }
+    });
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    // Watch providers
+    final dataAsync = ref.watch(exampleProvider);
+
+    return Scaffold(
+      // App bar
+      appBar: AppBar(
+        title: const Text('Example Screen'),
+        actions: [
+          IconButton(
+            icon: const Icon(Icons.refresh),
+            onPressed: () => ref.invalidate(exampleProvider),
+            tooltip: 'Refresh',
+          ),
+          IconButton(
+            icon: const Icon(Icons.settings),
+            onPressed: _navigateToSettings,
+            tooltip: 'Settings',
+          ),
+        ],
+      ),
+
+      // Body with async handling
+      body: dataAsync.when(
+        // Success state
+        data: (items) => _buildContent(items),
+
+        // Loading state
+        loading: () => const Center(
+          child: CircularProgressIndicator(),
+        ),
+
+        // Error state
+        error: (error, stackTrace) => _buildErrorState(error),
+      ),
+
+      // Floating action button
+      floatingActionButton: _showScrollToTop
+          ? FloatingActionButton(
+              onPressed: _scrollToTop,
+              child: const Icon(Icons.arrow_upward),
+            )
+          : null,
+    );
+  }
+
+  /// Builds main content
+  Widget _buildContent(List<dynamic> items) {
+    if (items.isEmpty) {
+      return _buildEmptyState();
+    }
+
+    return RefreshIndicator(
+      onRefresh: _handleRefresh,
+      child: CustomScrollView(
+        controller: _scrollController,
+        slivers: [
+          // Header
+          SliverToBoxAdapter(
+            child: Padding(
+              padding: const EdgeInsets.all(16),
+              child: Text(
+                '${items.length} Items',
+                style: Theme.of(context).textTheme.titleMedium,
+              ),
+            ),
+          ),
+
+          // List
+          SliverList(
+            delegate: SliverChildBuilderDelegate(
+              (context, index) {
+                final item = items[index];
+                return _buildListItem(item, index);
+              },
+              childCount: items.length,
+            ),
+          ),
+        ],
+      ),
+    );
+  }
+
+  /// Builds individual list item
+  Widget _buildListItem(dynamic item, int index) {
+    return Card(
+      margin: const EdgeInsets.symmetric(
+        horizontal: 16,
+        vertical: 8,
+      ),
+      child: ListTile(
+        leading: CircleAvatar(
+          child: Text('${index + 1}'),
+        ),
+        title: Text(item.title ?? 'Untitled'),
+        subtitle: Text(item.description ?? ''),
+        trailing: IconButton(
+          icon: const Icon(Icons.chevron_right),
+          onPressed: () => _navigateToDetail(item),
+        ),
+        onTap: () => _navigateToDetail(item),
+      ),
+    );
+  }
+
+  /// Builds empty state
+  Widget _buildEmptyState() {
+    return Center(
+      child: Column(
+        mainAxisAlignment: MainAxisAlignment.center,
+        children: [
+          Icon(
+            Icons.inbox,
+            size: 64,
+            color: Theme.of(context).colorScheme.secondary,
+          ),
+          const SizedBox(height: 16),
+          Text(
+            'No items yet',
+            style: Theme.of(context).textTheme.titleLarge,
+          ),
+          const SizedBox(height: 8),
+          Text(
+            'Add your first item to get started',
+            style: Theme.of(context).textTheme.bodyMedium?.copyWith(
+                  color: Theme.of(context).colorScheme.onSurface.withOpacity(0.6),
+                ),
+          ),
+          const SizedBox(height: 24),
+          ElevatedButton.icon(
+            onPressed: _showAddDialog,
+            icon: const Icon(Icons.add),
+            label: const Text('Add Item'),
+          ),
+        ],
+      ),
+    );
+  }
+
+  /// Builds error state
+  Widget _buildErrorState(Object error) {
+    return Center(
+      child: Padding(
+        padding: const EdgeInsets.all(24),
+        child: Column(
+          mainAxisAlignment: MainAxisAlignment.center,
+          children: [
+            Icon(
+              Icons.error_outline,
+              size: 64,
+              color: Theme.of(context).colorScheme.error,
+            ),
+            const SizedBox(height: 16),
+            Text(
+              'Oops! Something went wrong',
+              style: Theme.of(context).textTheme.titleLarge,
+              textAlign: TextAlign.center,
+            ),
+            const SizedBox(height: 8),
+            Text(
+              error.toString(),
+              style: Theme.of(context).textTheme.bodyMedium?.copyWith(
+                    color: Theme.of(context).colorScheme.onSurface.withOpacity(0.6),
+                  ),
+              textAlign: TextAlign.center,
+            ),
+            const SizedBox(height: 24),
+            ElevatedButton.icon(
+              onPressed: () => ref.invalidate(exampleProvider),
+              icon: const Icon(Icons.refresh),
+              label: const Text('Try Again'),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+
+  // Event handlers
+
+  Future<void> _handleRefresh() async {
+    await ref.refresh(exampleProvider.future);
+  }
+
+  void _scrollToTop() {
+    _scrollController.animateTo(
+      0,
+      duration: const Duration(milliseconds: 500),
+      curve: Curves.easeOut,
+    );
+  }
+
+  void _navigateToDetail(dynamic item) {
+    Navigator.of(context).pushNamed(
+      '/detail',
+      arguments: item,
+    );
+  }
+
+  void _navigateToSettings() {
+    Navigator.of(context).pushNamed('/settings');
+  }
+
+  void _showAddDialog() {
+    showDialog(
+      context: context,
+      builder: (context) => AlertDialog(
+        title: const Text('Add Item'),
+        content: TextField(
+          decoration: const InputDecoration(
+            labelText: 'Title',
+            hintText: 'Enter title',
+          ),
+          onSubmitted: (value) {
+            // Handle submission
+            Navigator.of(context).pop();
+          },
+        ),
+        actions: [
+          TextButton(
+            onPressed: () => Navigator.of(context).pop(),
+            child: const Text('Cancel'),
+          ),
+          ElevatedButton(
+            onPressed: () {
+              // Handle add
+              Navigator.of(context).pop();
+            },
+            child: const Text('Add'),
+          ),
+        ],
+      ),
+    );
+  }
+}
+
+// Placeholder provider (move to separate file)
+final exampleProvider = FutureProvider<List<dynamic>>((ref) async {
+  // Simulate API call
+  await Future.delayed(const Duration(seconds: 1));
+  return [];
+});
diff --git a/.agents/skills/mobile-agent/resources/snippets.md b/.agents/skills/mobile-agent/resources/snippets.md
new file mode 100644
index 0000000..a7ff7e5
--- /dev/null
+++ b/.agents/skills/mobile-agent/resources/snippets.md
@@ -0,0 +1,235 @@
+# Mobile Agent - Code Snippets
+
+Copy-paste ready patterns. Use these as starting points, adapt to the specific task.
+
+---
+
+## Riverpod AsyncNotifier
+
+```dart
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+part 'todo_provider.g.dart';
+
+@riverpod
+class TodoList extends _$TodoList {
+  @override
+  Future<List<Todo>> build() async {
+    final repository = ref.watch(todoRepositoryProvider);
+    return repository.fetchAll();
+  }
+
+  Future<void> add(String title) async {
+    final repository = ref.read(todoRepositoryProvider);
+    await repository.create(title);
+    ref.invalidateSelf();
+  }
+
+  Future<void> toggle(String id) async {
+    final repository = ref.read(todoRepositoryProvider);
+    await repository.toggle(id);
+    ref.invalidateSelf();
+  }
+
+  Future<void> delete(String id) async {
+    final repository = ref.read(todoRepositoryProvider);
+    await repository.delete(id);
+    ref.invalidateSelf();
+  }
+}
+```
+
+---
+
+## Screen with AsyncValue
+
+```dart
+import 'package:flutter/material.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+
+class TodoListScreen extends ConsumerWidget {
+  const TodoListScreen({super.key});
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final todosAsync = ref.watch(todoListProvider);
+
+    return Scaffold(
+      appBar: AppBar(title: const Text('Todos')),
+      body: todosAsync.when(
+        loading: () => const Center(child: CircularProgressIndicator()),
+        error: (error, stack) => Center(
+          child: Column(
+            mainAxisSize: MainAxisSize.min,
+            children: [
+              Text('Error: $error'),
+              const SizedBox(height: 8),
+              ElevatedButton(
+                onPressed: () => ref.invalidate(todoListProvider),
+                child: const Text('Retry'),
+              ),
+            ],
+          ),
+        ),
+        data: (todos) => todos.isEmpty
+            ? const Center(child: Text('No todos yet'))
+            : ListView.builder(
+                itemCount: todos.length,
+                itemBuilder: (context, index) => TodoItem(todo: todos[index]),
+              ),
+      ),
+      floatingActionButton: FloatingActionButton(
+        onPressed: () => _showAddDialog(context, ref),
+        child: const Icon(Icons.add),
+      ),
+    );
+  }
+}
+```
+
+---
+
+## Repository Pattern
+
+```dart
+abstract class TodoRepository {
+  Future<List<Todo>> fetchAll();
+  Future<Todo> create(String title);
+  Future<void> toggle(String id);
+  Future<void> delete(String id);
+}
+
+class TodoRepositoryImpl implements TodoRepository {
+  final Dio _dio;
+
+  TodoRepositoryImpl(this._dio);
+
+  @override
+  Future<List<Todo>> fetchAll() async {
+    final response = await _dio.get('/api/todos');
+    return (response.data as List).map((e) => Todo.fromJson(e)).toList();
+  }
+
+  @override
+  Future<Todo> create(String title) async {
+    final response = await _dio.post('/api/todos', data: {'title': title});
+    return Todo.fromJson(response.data);
+  }
+
+  @override
+  Future<void> toggle(String id) async {
+    await _dio.patch('/api/todos/$id/toggle');
+  }
+
+  @override
+  Future<void> delete(String id) async {
+    await _dio.delete('/api/todos/$id');
+  }
+}
+```
+
+---
+
+## Dio with Auth Interceptor
+
+```dart
+class AuthInterceptor extends Interceptor {
+  final Ref _ref;
+
+  AuthInterceptor(this._ref);
+
+  @override
+  void onRequest(RequestOptions options, RequestInterceptorHandler handler) {
+    final token = _ref.read(authProvider).accessToken;
+    if (token != null) {
+      options.headers['Authorization'] = 'Bearer $token';
+    }
+    handler.next(options);
+  }
+
+  @override
+  void onError(DioException err, ErrorInterceptorHandler handler) {
+    if (err.response?.statusCode == 401) {
+      _ref.read(authProvider.notifier).logout();
+    }
+    handler.next(err);
+  }
+}
+```
+
+---
+
+## GoRouter Config
+
+```dart
+final routerProvider = Provider<GoRouter>((ref) {
+  final auth = ref.watch(authProvider);
+
+  return GoRouter(
+    redirect: (context, state) {
+      final isLoggedIn = auth.isAuthenticated;
+      final isAuthRoute = state.matchedLocation.startsWith('/auth');
+
+      if (!isLoggedIn && !isAuthRoute) return '/auth/login';
+      if (isLoggedIn && isAuthRoute) return '/';
+      return null;
+    },
+    routes: [
+      GoRoute(path: '/', builder: (_, __) => const HomeScreen()),
+      GoRoute(path: '/auth/login', builder: (_, __) => const LoginScreen()),
+      GoRoute(path: '/todos', builder: (_, __) => const TodoListScreen()),
+    ],
+  );
+});
+```
+
+---
+
+## Entity (freezed)
+
+```dart
+import 'package:freezed_annotation/freezed_annotation.dart';
+
+part 'todo.freezed.dart';
+part 'todo.g.dart';
+
+@freezed
+class Todo with _$Todo {
+  const factory Todo({
+    required String id,
+    required String title,
+    @Default(false) bool completed,
+    required DateTime createdAt,
+  }) = _Todo;
+
+  factory Todo.fromJson(Map<String, dynamic> json) => _$TodoFromJson(json);
+}
+```
+
+---
+
+## Widget Test
+
+```dart
+import 'package:flutter_test/flutter_test.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+
+void main() {
+  testWidgets('TodoListScreen shows loading then data', (tester) async {
+    await tester.pumpWidget(
+      ProviderScope(
+        overrides: [
+          todoListProvider.overrideWith(() => MockTodoList()),
+        ],
+        child: const MaterialApp(home: TodoListScreen()),
+      ),
+    );
+
+    expect(find.byType(CircularProgressIndicator), findsOneWidget);
+
+    await tester.pumpAndSettle();
+
+    expect(find.text('Test Todo'), findsOneWidget);
+  });
+}
+```
diff --git a/.agents/skills/mobile-agent/resources/tech-stack.md b/.agents/skills/mobile-agent/resources/tech-stack.md
new file mode 100644
index 0000000..a60016f
--- /dev/null
+++ b/.agents/skills/mobile-agent/resources/tech-stack.md
@@ -0,0 +1,45 @@
+# Mobile Agent - Tech Stack Reference
+
+## Flutter (Recommended)
+- **Framework**: Flutter 3.19+
+- **Language**: Dart 3.3+
+- **State**: Riverpod 2.4+, Bloc, Provider
+- **Navigation**: GoRouter 13+
+- **API Client**: Dio
+- **Local Storage**: Drift, Hive
+- **Testing**: flutter_test, mockito
+
+## React Native (Alternative)
+- **Framework**: React Native 0.73+
+- **Language**: TypeScript
+- **State**: Redux Toolkit, Zustand
+- **Navigation**: React Navigation 6+
+- **Testing**: Jest, React Native Testing Library
+
+## Project Structure (Flutter)
+
+```
+lib/
+  main.dart
+  core/              # Theme, router, utils
+  features/
+    [feature]/
+      data/          # Models, repositories
+      domain/        # Entities, use cases
+      presentation/  # Screens, widgets, providers
+  shared/            # Shared widgets
+```
+
+## Architecture Pattern
+
+Clean Architecture with Riverpod:
+1. Entity (Domain) - Pure business objects
+2. Repository Interface (Domain) - Abstract data access
+3. Repository Implementation (Data) - Dio, database
+4. Providers (Presentation) - State management
+5. Screens/Widgets (Presentation) - UI
+
+## Platform Guidelines
+- Material Design 3 for Android
+- iOS Human Interface Guidelines for iOS
+- Use `Platform.isIOS` for platform-specific code
diff --git a/.agents/skills/orchestrator/SKILL.md b/.agents/skills/orchestrator/SKILL.md
new file mode 100644
index 0000000..282d159
--- /dev/null
+++ b/.agents/skills/orchestrator/SKILL.md
@@ -0,0 +1,185 @@
+---
+name: orchestrator
+description: Automated multi-agent orchestrator that spawns CLI subagents in parallel, coordinates via MCP Memory, and monitors progress. Use for orchestration, parallel execution, and automated multi-agent workflows.
+---
+
+# Orchestrator - Automated Multi-Agent Coordinator
+
+## When to use
+- Complex feature requires multiple specialized agents working in parallel
+- User wants automated execution without manually spawning agents
+- Full-stack implementation spanning backend, frontend, mobile, and QA
+- User says "run it automatically", "run in parallel", or similar automation requests
+
+## When NOT to use
+- Simple single-domain task -> use the specific agent directly
+- User wants step-by-step manual control -> use workflow-guide
+- Quick bug fixes or minor changes
+
+## Important
+This skill orchestrates CLI subagents via `oh-my-ag agent:spawn`. The CLI vendor (gemini, claude, codex, qwen) is resolved from configuration. Vendor-specific execution protocols are injected automatically. Each subagent runs as an independent process.
+
+## Configuration
+
+| Setting | Default | Description |
+|---------|---------|-------------|
+| MAX_PARALLEL | 3 | Max concurrent subagents |
+| MAX_RETRIES | 2 | Retry attempts per failed task |
+| POLL_INTERVAL | 30s | Status check interval |
+| MAX_TURNS (impl) | 20 | Turn limit for backend/frontend/mobile |
+| MAX_TURNS (review) | 15 | Turn limit for qa/debug |
+| MAX_TURNS (plan) | 10 | Turn limit for pm |
+
+## Memory Configuration
+
+Memory provider and tool names are configurable via `mcp.json`:
+```json
+{
+  "memoryConfig": {
+    "provider": "serena",
+    "basePath": ".serena/memories",
+    "tools": {
+      "read": "read_memory",
+      "write": "write_memory",
+      "edit": "edit_memory"
+    }
+  }
+}
+```
+
+## Workflow Phases
+
+**PHASE 1 - Plan**: Analyze request -> decompose tasks -> generate session ID
+**PHASE 2 - Setup**: Use memory write tool to create `orchestrator-session.md` + `task-board.md`
+**PHASE 3 - Execute**: Spawn agents by priority tier (never exceed MAX_PARALLEL)
+**PHASE 4 - Monitor**: Poll every POLL_INTERVAL; handle completed/failed/crashed agents
+**PHASE 4.5 - Verify**: Run `oh-my-ag verify {agent-type}` per completed agent
+**PHASE 5 - Collect**: Read all `result-{agent}.md`, compile summary, cleanup progress files
+
+See `resources/subagent-prompt-template.md` for prompt construction.
+See `resources/memory-schema.md` for memory file formats.
+
+## Memory File Ownership
+
+| File | Owner | Others |
+|------|-------|--------|
+| `orchestrator-session.md` | orchestrator | read-only |
+| `task-board.md` | orchestrator | read-only |
+| `progress-{agent}.md` | that agent | orchestrator reads |
+| `result-{agent}.md` | that agent | orchestrator reads |
+
+## Agent-to-Agent Review Loop (PHASE 4.5)
+
+After each agent completes, enter an iterative review loop — not a single-pass verification.
+
+### Loop Flow
+
+```
+Agent completes work
+    ↓
+[1] Self-Review: Agent reviews its own changes
+    ↓
+[2] Verify: Run `oh-my-ag verify {agent-type} --workspace {workspace}`
+    ↓ FAIL → Agent receives feedback, fixes, back to [1]
+    ↓ PASS
+[3] Cross-Review: QA agent reviews the changes
+    ↓ FAIL → Agent receives review feedback, fixes, back to [1]
+    ↓ PASS
+Accept result ✓
+```
+
+### Step Details
+
+**[1] Self-Review**: Before requesting external review, the implementation agent must:
+- Re-read its own diff and check against the task's acceptance criteria
+- Run lint, type-check, and tests in the workspace
+- Fix any issues found before proceeding
+
+**[2] Automated Verify**:
+```bash
+oh-my-ag verify {agent-type} --workspace {workspace} --json
+```
+- **PASS (exit 0)**: Proceed to cross-review
+- **FAIL (exit 1)**: Feed verify output back to the agent as correction context
+
+**[3] Cross-Review**: Spawn QA agent to review the changes:
+- QA agent reads the diff, runs checks, evaluates against acceptance criteria
+- If `docs/CODE-REVIEW.md` exists, QA agent uses it as the review checklist
+- QA agent outputs: PASS (with optional nits) or FAIL (with specific issues)
+- On FAIL: issues are fed back to the implementation agent for fixing
+
+### Loop Limits
+
+| Counter | Max | On Exceeded |
+|---------|-----|-------------|
+| Self-review + fix cycles | 3 | Escalate to cross-review regardless |
+| Cross-review rejections | 2 | Report to user with review history |
+| Total loop iterations | 5 | Force-complete with quality warning |
+
+### Review Feedback Format
+
+When feeding review results back to the implementation agent:
+```
+## Review Feedback (iteration {n}/{max})
+**Reviewer**: {self / verify / qa-agent}
+**Verdict**: FAIL
+**Issues**:
+1. {specific issue with file and line reference}
+2. {specific issue}
+**Fix instruction**: {what to change}
+```
+
+This replaces single-pass verification. Most "nitpicking" should happen agent-to-agent.
+Human review is reserved for final approval, not catching lint errors.
+
+## Retry Logic (after review loop exhaustion)
+- 1st retry: Re-spawn agent with full review history as context
+- 2nd retry: Re-spawn with "Try a different approach" + review history
+- Final failure: Report to user with complete review trail, ask whether to continue or abort
+
+## Clarification Debt (CD) Monitoring
+
+Track user corrections during session execution. See `../_shared/session-metrics.md` for full protocol.
+
+### Event Classification
+When user sends feedback during session:
+- **clarify** (+10): User answering agent's question
+- **correct** (+25): User correcting agent's misunderstanding
+- **redo** (+40): User rejecting work, requesting restart
+
+### Threshold Actions
+| CD Score | Action |
+|----------|--------|
+| CD >= 50 | **RCA Required**: QA agent must add entry to `lessons-learned.md` |
+| CD >= 80 | **Session Pause**: Request user to re-specify requirements |
+| `redo` >= 2 | **Scope Lock**: Request explicit allowlist confirmation before continuing |
+
+### Recording
+After each user correction event:
+```
+[EDIT]("session-metrics.md", append event to Events table)
+```
+
+At session end, if CD >= 50:
+1. Include CD summary in final report
+2. Trigger QA agent RCA generation
+3. Update `lessons-learned.md` with prevention measures
+
+
+
+## References
+- Prompt template: `resources/subagent-prompt-template.md`
+- Memory schema: `resources/memory-schema.md`
+- Config: `config/cli-config.yaml`
+- Scripts: `scripts/spawn-agent.sh`, `scripts/parallel-run.sh`, `scripts/verify.sh`
+- Task templates: `templates/`
+- Skill routing: `../_shared/skill-routing.md`
+- Verification: `scripts/verify.sh <agent-type>`
+- Session metrics: `../_shared/session-metrics.md`
+- API contracts: `../_shared/api-contracts/`
+- Context loading: `../_shared/context-loading.md`
+- Difficulty guide: `../_shared/difficulty-guide.md`
+- Reasoning templates: `../_shared/reasoning-templates.md`
+- Clarification protocol: `../_shared/clarification-protocol.md`
+- Context budget: `../_shared/context-budget.md`
+- Lessons learned: `../_shared/lessons-learned.md`
diff --git a/.agents/skills/orchestrator/config/cli-config.yaml b/.agents/skills/orchestrator/config/cli-config.yaml
new file mode 100644
index 0000000..c6d0908
--- /dev/null
+++ b/.agents/skills/orchestrator/config/cli-config.yaml
@@ -0,0 +1,69 @@
+# SubAgent CLI Configuration
+# Select your preferred CLI vendor for sub-agent execution
+
+# Default CLI vendor (used as fallback when user-preferences.yaml is not configured)
+# For per-agent CLI mapping, see: .agents/config/user-preferences.yaml
+active_vendor: gemini
+
+# Vendor configurations
+vendors:
+  gemini:
+    command: gemini
+    prompt_flag: "-p"
+    output_format_flag: "--output-format"
+    output_format: "json"
+    auto_approve_flag: "--approval-mode=yolo"
+    model_flag: "-m"
+    default_model: "auto"
+    include_dirs_flag: "--include-directories"
+    # JSON output parsing
+    response_jq: ".response"
+    # Isolation: gemini uses current directory context
+    isolation_method: "directory"
+
+  claude:
+    command: claude
+    prompt_flag: "-p"
+    output_format_flag: "--output-format"
+    output_format: "json"
+    auto_approve_flag: "--dangerously-skip-permissions"
+    model_flag: "--model"
+    default_model: "sonnet"
+    # JSON output parsing
+    response_jq: ".result"
+    isolation_method: "flags"
+
+  codex:
+    command: codex
+    subcommand: "exec"
+    prompt_flag: "none"
+    output_format_flag: "--json"
+    auto_approve_flag: "--full-auto"
+    model_flag: "-m"
+    default_model: "gpt-5.3-codex"
+    # Environment variable for isolation
+    isolation_env: "CODEX_HOME=/tmp/codex-subagent-$$"
+    response_jq: ".response"
+    isolation_method: "env"
+
+  qwen:
+    command: qwen
+    prompt_flag: "-p"
+    output_format_flag: "--output-format"
+    output_format: "json"
+    auto_approve_flag: "--yolo"
+    model_flag: "-m"
+    default_model: "qwen3-coder-plus"
+    response_jq: ".output"
+    isolation_method: "directory"
+
+# SubAgent execution settings
+execution:
+  # Directory for subagent results
+  results_dir: ".agents/results"
+  # Timeout in seconds (0 = no timeout)
+  timeout: 600
+  # Log level: debug, info, warn, error
+  log_level: info
+  # Keep intermediate files for debugging
+  keep_temp_files: false
diff --git a/.agents/skills/orchestrator/resources/memory-schema.md b/.agents/skills/orchestrator/resources/memory-schema.md
new file mode 100644
index 0000000..f9b2bd2
--- /dev/null
+++ b/.agents/skills/orchestrator/resources/memory-schema.md
@@ -0,0 +1,212 @@
+# MCP Memory Schema for Multi-Agent Orchestration
+
+## Overview
+
+Each subagent writes only to its own dedicated files. The orchestrator manages session-level files. This ownership model prevents write conflicts between concurrent agents.
+
+## Configuration
+
+Memory base path and tool names are configurable via `mcp.json`:
+```json
+{
+  "memoryConfig": {
+    "basePath": ".serena/memories",
+    "tools": {
+      "read": "read_memory",
+      "write": "write_memory",
+      "edit": "edit_memory"
+    }
+  }
+}
+```
+
+Default base path: `.serena/memories`
+
+## File Structure
+
+```
+{memoryConfig.basePath}/
+  orchestrator-session.md    # Session metadata (orchestrator only)
+  task-board.md              # Master task list (orchestrator writes, agents read)
+  progress-{agent-id}.md    # Per-agent progress log (owning agent only)
+  result-{agent-id}.md      # Per-agent final result (owning agent only)
+```
+
+## orchestrator-session.md
+
+Created by the orchestrator at session start. Updated throughout execution.
+
+```markdown
+# Orchestrator Session
+## ID: session-{YYYYMMDD}-{HHMMSS}
+## Started: {ISO timestamp}
+## Status: running | completed | failed | aborted
+
+## Agents
+| Agent ID | CLI | PID | Status | Task |
+|----------|-----|-----|--------|------|
+| backend  | gemini | 12345 | running | task-1 |
+| frontend | gemini | 12346 | completed | task-2 |
+| mobile   | claude | 12347 | running | task-3 |
+
+## Configuration
+- MAX_PARALLEL: 3
+- MAX_RETRIES: 2
+- POLL_INTERVAL: 30s
+
+## Summary (filled on completion)
+- Total Tasks: X
+- Completed: X
+- Failed: X
+- Files Created: [list]
+- Issues: [list]
+```
+
+## task-board.md
+
+Master task list created by the orchestrator. Subagents read this to understand their assignment but never write to it.
+
+```markdown
+# Task Board
+## Session: session-{YYYYMMDD}-{HHMMSS}
+
+### task-1
+- **Agent**: backend
+- **CLI**: gemini
+- **Title**: JWT authentication API
+- **Status**: pending | in_progress | completed | failed | blocked
+- **Priority**: 1
+- **Dependencies**: none
+- **Description**: Implement user registration and login with JWT tokens
+- **Acceptance Criteria**:
+  - POST /api/auth/register with email + password
+  - POST /api/auth/login returns access + refresh tokens
+  - Password hashing with bcrypt
+  - Rate limiting on auth endpoints
+
+### task-2
+- **Agent**: frontend
+- **CLI**: gemini
+- **Title**: Login and registration UI
+- **Status**: pending
+- **Priority**: 1
+- **Dependencies**: none
+- **Description**: Build login and registration forms with validation
+- **Acceptance Criteria**:
+  - Login form with email + password
+  - Registration form with validation
+  - Error handling for failed auth
+  - JWT token storage and auto-refresh
+
+### task-3
+- **Agent**: qa
+- **CLI**: gemini
+- **Title**: Security and performance review
+- **Status**: blocked
+- **Priority**: 2
+- **Dependencies**: task-1, task-2
+- **Description**: Review all deliverables for security and performance
+- **Acceptance Criteria**:
+  - OWASP Top 10 security check
+  - Performance benchmarks pass
+  - No critical or high severity issues
+```
+
+## progress-{agent-id}.md
+
+Each agent creates this file at start and appends entries every 3-5 turns. Only the owning agent writes to this file.
+
+```markdown
+# Progress: backend
+## Task: task-1
+## Agent ID: backend
+## Started: {ISO timestamp}
+
+### Turn 1 - {ISO timestamp}
+- **Action**: Reading task-board.md and understanding requirements
+- **Status**: in_progress
+- **Details**: Identified 4 acceptance criteria for JWT auth API
+
+### Turn 5 - {ISO timestamp}
+- **Action**: Created user model and auth endpoints
+- **Status**: in_progress
+- **Details**: Implemented POST /api/auth/register and /api/auth/login
+- **Files**: app/models/user.py, app/api/auth.py
+
+### Turn 12 - {ISO timestamp}
+- **Action**: Added tests and rate limiting
+- **Status**: in_progress
+- **Details**: 15 test cases passing, rate limiter configured
+
+### Turn 18 - {ISO timestamp}
+- **Action**: All acceptance criteria met
+- **Status**: completed
+- **Summary**: JWT auth API fully implemented with tests
+```
+
+## result-{agent-id}.md
+
+Each agent creates this file upon completion (success or failure). Only the owning agent writes to this file.
+
+```markdown
+# Result: backend
+## Task: task-1
+## Status: completed
+## Turns Used: 18
+
+## Summary
+Implemented JWT authentication API with user registration, login,
+password hashing (bcrypt), and rate limiting.
+
+## Files Created/Modified
+- `app/models/user.py` (NEW) - User model with password hashing
+- `app/api/auth.py` (NEW) - Auth endpoints
+- `app/middleware/rate_limit.py` (NEW) - Rate limiting middleware
+- `tests/test_auth.py` (NEW) - 15 test cases
+- `alembic/versions/001_create_users.py` (NEW) - Migration
+
+## Acceptance Criteria
+- [x] POST /api/auth/register with email + password
+- [x] POST /api/auth/login returns access + refresh tokens
+- [x] Password hashing with bcrypt
+- [x] Rate limiting on auth endpoints
+
+## Issues Encountered
+- None
+
+## Notes
+- Access token expiry: 15 minutes
+- Refresh token expiry: 7 days
+- Rate limit: 5 requests/minute on login endpoint
+```
+
+### Failed Result Example
+
+```markdown
+# Result: backend
+## Task: task-1
+## Status: failed
+## Turns Used: 20
+
+## Summary
+Unable to complete JWT auth API. Database connection issues prevented testing.
+
+## Files Created/Modified
+- `app/models/user.py` (NEW) - User model (untested)
+- `app/api/auth.py` (NEW) - Auth endpoints (untested)
+
+## Acceptance Criteria
+- [x] POST /api/auth/register with email + password
+- [x] POST /api/auth/login returns access + refresh tokens
+- [x] Password hashing with bcrypt
+- [ ] Rate limiting on auth endpoints (NOT DONE)
+
+## Issues Encountered
+- PostgreSQL connection refused on localhost:5432
+- Could not run integration tests
+- Rate limiting implementation incomplete due to turn limit
+
+## Notes
+- Needs database running to complete testing
+- Rate limiting code is written but untested
+```
diff --git a/.agents/skills/orchestrator/resources/subagent-prompt-template.md b/.agents/skills/orchestrator/resources/subagent-prompt-template.md
new file mode 100644
index 0000000..22c2c3d
--- /dev/null
+++ b/.agents/skills/orchestrator/resources/subagent-prompt-template.md
@@ -0,0 +1,103 @@
+# Subagent Prompt Template
+
+This template is used by the orchestrator to construct self-contained prompts for CLI subagents. The vendor-specific CLI flags and execution protocol are injected automatically by `oh-my-ag agent:spawn`.
+
+## Template
+
+The orchestrator fills in the `{placeholders}` and passes the assembled prompt to `oh-my-ag agent:spawn`.
+
+---
+
+```
+You are a {AGENT_ROLE} working as part of an automated multi-agent system.
+You have been assigned a specific task and must complete it autonomously.
+
+## Your Expertise
+
+{AGENT_SKILL_CONTENT}
+
+## Assigned Task
+
+**Task ID**: {TASK_ID}
+**Title**: {TASK_TITLE}
+**Priority**: {TASK_PRIORITY}
+
+### Description
+{TASK_DESCRIPTION}
+
+### Acceptance Criteria
+{ACCEPTANCE_CRITERIA}
+
+## Working Directory
+{WORKSPACE_PATH}
+
+## Turn Limit
+You have a maximum of {MAX_TURNS} turns to complete this task.
+If you are running low on turns, prioritize:
+1. Save your current progress to the result file
+2. Document what remains incomplete
+3. Ensure created files are in a usable state
+
+## Execution Protocol
+
+The execution protocol (state management, progress reporting, result format) is automatically injected by `oh-my-ag agent:spawn` based on the configured CLI vendor. See `.agents/skills/_shared/execution-protocols/` for vendor-specific protocols.
+
+Follow the injected execution protocol for:
+- Reading your task assignment on start
+- Reporting progress during execution
+- Creating result files on completion or failure
+
+## Charter Preflight (MANDATORY)
+
+Before ANY code changes, you MUST output this block in your first response:
+
+```
+CHARTER_CHECK:
+- Clarification level: {LOW | MEDIUM | HIGH}
+- Task domain: {your assigned domain, e.g., "backend API", "frontend UI"}
+- Must NOT do: {3 constraints from task or general rules}
+- Success criteria: {from acceptance criteria, measurable}
+- Assumptions: {any defaults you're applying}
+```
+
+**Rules for Clarification Level:**
+- **LOW**: Core requirements clear, details can use defaults → Proceed with assumptions listed
+- **MEDIUM**: 2+ valid interpretations possible → List options in result, proceed with most likely
+- **HIGH**: Cannot determine intent → Set `Status: blocked` and list questions. DO NOT write code.
+
+If you cannot fill this block completely, you are not ready to start. Ask for clarification.
+
+---
+
+## Rules
+
+1. **Stay in scope**: Only work on your assigned task. Do not modify files outside your task's domain.
+2. **No destructive actions without checking**: Before deleting or overwriting files, verify they belong to your task scope.
+3. **Write tests**: Include tests for any code you create.
+4. **Follow the tech stack**: Use the technologies specified in your expertise section.
+5. **Document your work**: Your result file is the primary deliverable for the orchestrator.
+6. **Charter first**: Always output CHARTER_CHECK before any implementation.
+
+If you discover a necessary change outside your domain:
+1. Document it in your result file under "Out-of-Scope Dependencies"
+2. Do NOT make the change yourself
+3. Orchestrator will create a separate task if needed
+```
+
+---
+
+## Placeholder Reference
+
+| Placeholder | Source | Example |
+|-------------|--------|---------|
+| `{AGENT_ROLE}` | Agent SKILL.md title | "Backend Specialist" |
+| `{AGENT_ID}` | Task assignment | "backend" |
+| `{AGENT_SKILL_CONTENT}` | Agent SKILL.md (tech stack, architecture, checklist sections) | Full markdown content |
+| `{TASK_ID}` | task-board.md | "task-1" |
+| `{TASK_TITLE}` | task-board.md | "JWT authentication API" |
+| `{TASK_PRIORITY}` | task-board.md | "1" |
+| `{TASK_DESCRIPTION}` | task-board.md | Full description text |
+| `{ACCEPTANCE_CRITERIA}` | task-board.md | Bulleted list |
+| `{WORKSPACE_PATH}` | Orchestrator config | "/path/to/project" |
+| `{MAX_TURNS}` | Orchestrator config | "20" |
+| `{MAX_TURNS_WARNING}` | MAX_TURNS - 3 | "17" |
diff --git a/.agents/skills/orchestrator/scripts/parallel-run.sh b/.agents/skills/orchestrator/scripts/parallel-run.sh
new file mode 100644
index 0000000..fd14586
--- /dev/null
+++ b/.agents/skills/orchestrator/scripts/parallel-run.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# parallel-run.sh - Wrapper for oh-my-ag agent:parallel
+# Usage: ./parallel-run.sh <tasks-file.yaml> [--vendor <vendor>]
+#        ./parallel-run.sh --inline "backend:task1" "frontend:task2" ...
+
+exec oh-my-ag agent:parallel "$@"
diff --git a/.agents/skills/orchestrator/scripts/spawn-agent.sh b/.agents/skills/orchestrator/scripts/spawn-agent.sh
new file mode 100644
index 0000000..7878adb
--- /dev/null
+++ b/.agents/skills/orchestrator/scripts/spawn-agent.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# spawn-agent.sh - Wrapper for oh-my-ag agent:spawn
+# Usage: ./spawn-agent.sh <agent-id> <prompt> <session-id> [-w workspace] [-v vendor]
+
+exec oh-my-ag agent:spawn "$@"
diff --git a/.agents/skills/orchestrator/scripts/verify.sh b/.agents/skills/orchestrator/scripts/verify.sh
new file mode 100644
index 0000000..bb178dd
--- /dev/null
+++ b/.agents/skills/orchestrator/scripts/verify.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# verify.sh - Wrapper for oh-my-ag verify
+# Usage: ./verify.sh <agent-type> [workspace-path]
+
+AGENT_TYPE="${1:-}"
+WORKSPACE="${2:-.}"
+
+exec oh-my-ag verify "$AGENT_TYPE" --workspace "$WORKSPACE"
diff --git a/.agents/skills/orchestrator/templates/backend-task.md b/.agents/skills/orchestrator/templates/backend-task.md
new file mode 100644
index 0000000..b6187fd
--- /dev/null
+++ b/.agents/skills/orchestrator/templates/backend-task.md
@@ -0,0 +1,18 @@
+# Backend SubAgent Task
+
+You are a Backend specialist. Focus only on the task below.
+
+## Guidelines
+- Use FastAPI with async/await
+- SQLAlchemy for database operations
+- Pydantic for validation
+- JWT for authentication
+- Follow REST conventions
+- Include error handling
+- Write tests for new code
+
+## Output Requirements
+- Implement the requested functionality
+- Create/modify necessary files
+- Add appropriate tests
+- Document API endpoints if created
diff --git a/.agents/skills/orchestrator/templates/debug-task.md b/.agents/skills/orchestrator/templates/debug-task.md
new file mode 100644
index 0000000..334a32c
--- /dev/null
+++ b/.agents/skills/orchestrator/templates/debug-task.md
@@ -0,0 +1,16 @@
+# Debug SubAgent Task
+
+You are a Debug specialist. Focus only on fixing the bug below.
+
+## Approach
+1. Reproduce the issue
+2. Identify root cause
+3. Implement fix
+4. Add regression test
+5. Document the fix
+
+## Output Requirements
+- Explain the root cause
+- Show before/after code
+- Include regression test
+- List related patterns to check
diff --git a/.agents/skills/orchestrator/templates/frontend-task.md b/.agents/skills/orchestrator/templates/frontend-task.md
new file mode 100644
index 0000000..640075d
--- /dev/null
+++ b/.agents/skills/orchestrator/templates/frontend-task.md
@@ -0,0 +1,17 @@
+# Frontend SubAgent Task
+
+You are a Frontend specialist. Focus only on the task below.
+
+## Guidelines
+- React with TypeScript
+- TailwindCSS for styling
+- React Query for data fetching
+- Proper loading/error states
+- Accessible components (WCAG 2.1 AA)
+- Mobile-responsive design
+
+## Output Requirements
+- Implement the requested UI/feature
+- Create/modify necessary components
+- Add component tests if appropriate
+- Ensure responsive behavior
diff --git a/.agents/skills/orchestrator/templates/mobile-task.md b/.agents/skills/orchestrator/templates/mobile-task.md
new file mode 100644
index 0000000..459769a
--- /dev/null
+++ b/.agents/skills/orchestrator/templates/mobile-task.md
@@ -0,0 +1,17 @@
+# Mobile SubAgent Task
+
+You are a Mobile specialist. Focus only on the task below.
+
+## Guidelines
+- Flutter with Dart
+- Clean Architecture (presentation/domain/data)
+- Riverpod for state management
+- Platform-aware UI components
+- Proper navigation handling
+- Offline-first when applicable
+
+## Output Requirements
+- Implement the requested screen/feature
+- Create/modify necessary files
+- Handle both iOS and Android
+- Test on multiple screen sizes
diff --git a/.agents/skills/orchestrator/templates/qa-task.md b/.agents/skills/orchestrator/templates/qa-task.md
new file mode 100644
index 0000000..841db53
--- /dev/null
+++ b/.agents/skills/orchestrator/templates/qa-task.md
@@ -0,0 +1,16 @@
+# QA SubAgent Task
+
+You are a QA specialist. Focus only on the review below.
+
+## Review Checklist
+- Security (OWASP Top 10)
+- Performance (bundle size, API latency)
+- Accessibility (WCAG 2.1 AA)
+- Code quality (complexity, duplication)
+- Test coverage
+
+## Output Requirements
+- List issues found with severity (CRITICAL/HIGH/MEDIUM/LOW)
+- Provide specific file:line references
+- Suggest fixes for each issue
+- Prioritize actionable feedback
diff --git a/.agents/skills/orchestrator/templates/tasks-example.yaml b/.agents/skills/orchestrator/templates/tasks-example.yaml
new file mode 100644
index 0000000..7436fe1
--- /dev/null
+++ b/.agents/skills/orchestrator/templates/tasks-example.yaml
@@ -0,0 +1,15 @@
+# Example parallel tasks file
+# Usage: ./parallel-run.sh tasks-example.yaml
+
+tasks:
+  - agent: backend
+    task: "Implement JWT authentication with register and login endpoints"
+    workspace: ./backend
+
+  - agent: frontend
+    task: "Create login and registration forms with validation"
+    workspace: ./frontend
+
+  - agent: mobile
+    task: "Build authentication screens for iOS and Android"
+    workspace: ./mobile
diff --git a/.agents/skills/pm-agent/SKILL.md b/.agents/skills/pm-agent/SKILL.md
new file mode 100644
index 0000000..98c045b
--- /dev/null
+++ b/.agents/skills/pm-agent/SKILL.md
@@ -0,0 +1,55 @@
+---
+name: pm-agent
+description: Product manager that decomposes requirements into actionable tasks with priorities and dependencies. Use for planning, requirements, specification, scope, prioritization, task breakdown, and ISO 21500, ISO 31000, or ISO 38500-aligned planning recommendations.
+---
+
+# PM Agent - Product Manager
+
+## When to use
+- Breaking down complex feature requests into tasks
+- Determining technical feasibility and architecture
+- Prioritizing work and planning sprints
+- Defining API contracts and data models
+
+## When NOT to use
+- Implementing actual code -> delegate to specialized agents
+- Performing code reviews -> use QA Agent
+
+## Core Rules
+1. API-first design: define contracts before implementation tasks
+2. Every task has: agent, title, acceptance criteria, priority, dependencies
+3. Minimize dependencies for maximum parallel execution
+4. Security and testing are part of every task (not separate phases)
+5. Tasks should be completable by a single agent
+6. Output JSON plan + task-board.md for orchestrator compatibility
+7. When relevant, structure plans using ISO 21500 concepts, risk prioritization using ISO 31000 thinking, and responsibility/governance suggestions inspired by ISO 38500
+
+## How to Execute
+Follow `resources/execution-protocol.md` step by step.
+See `resources/examples.md` for input/output examples.
+Use `resources/iso-planning.md` when the user needs standards-based planning, risk framing, or governance-oriented recommendations.
+Save plan to `.agents/plan.json` and `.agents/brain/current-plan.md`.
+
+## Common Pitfalls
+- Too Granular: "Implement user auth API" is one task, not five
+- Vague Tasks: "Make it better" -> "Add loading states to all forms"
+- Tight Coupling: tasks should use public APIs, not internal state
+- Deferred Quality: testing is part of every task, not a final phase
+
+## Execution Protocol (CLI Mode)
+
+See `../_shared/execution-protocols/` for vendor-specific protocols.
+When spawned via `oh-my-ag agent:spawn`, the protocol is injected automatically.
+
+## References
+- Execution steps: `resources/execution-protocol.md`
+- Plan examples: `resources/examples.md`
+- ISO planning guide: `resources/iso-planning.md`
+- Error recovery: `resources/error-playbook.md`
+- Task schema: `resources/task-template.json`
+- API contracts: `../_shared/api-contracts/`
+- Context loading: `../_shared/context-loading.md`
+- Reasoning templates: `../_shared/reasoning-templates.md`
+- Clarification: `../_shared/clarification-protocol.md`
+- Context budget: `../_shared/context-budget.md`
+- Lessons learned: `../_shared/lessons-learned.md`
diff --git a/.agents/skills/pm-agent/resources/error-playbook.md b/.agents/skills/pm-agent/resources/error-playbook.md
new file mode 100644
index 0000000..b5e059c
--- /dev/null
+++ b/.agents/skills/pm-agent/resources/error-playbook.md
@@ -0,0 +1,75 @@
+# PM Agent - Error Recovery Playbook
+
+When you encounter a failure during planning, follow these recovery steps.
+
+---
+
+## Requirements Ambiguous
+
+**Symptoms**: User request is vague ("Make me a good app", "Make it better")
+
+1. Break down what you DO understand
+2. List specific assumptions you're making
+3. Create plan based on reasonable assumptions
+4. Mark assumptions clearly: `⚠️ Assumption: [description]`
+5. **NEVER do this**: Create tasks while still ambiguous — agents will lose direction
+
+---
+
+## Existing Codebase Unknown
+
+**Symptoms**: Planning for an existing project but don't know the architecture
+
+1. Use Serena: `get_symbols_overview("src/")` or `get_symbols_overview("app/")`
+2. Look for framework indicators: `package.json`, `pyproject.toml`, `pubspec.yaml`
+3. Check for existing patterns: `search_for_pattern("@app.get|@app.post")` (FastAPI)
+4. If Serena unavailable: note in plan "architecture assumptions — verify before execution"
+
+---
+
+## Task Decomposition Too Granular or Too Coarse
+
+**Self-check**:
+- Each task should take 1 agent, 10-20 turns
+- If a task needs < 5 turns: merge with a related task
+- If a task needs > 30 turns: split into sub-tasks
+- If unsure: err on the side of fewer, larger tasks
+
+---
+
+## Dependency Deadlock
+
+**Symptoms**: Task A depends on B, B depends on A (circular)
+
+1. Identify the cycle
+2. Break it by defining an API contract or shared interface first
+3. Create a priority-0 task: "Define API contracts" (no dependencies)
+4. Both tasks then depend on the contract, not on each other
+
+---
+
+## Tech Stack Decision Unclear
+
+**Symptoms**: Multiple valid options, no clear winner
+
+1. Check existing codebase — consistency wins over "better" tech
+2. If greenfield: use the project's default stack (see SKILL.md tech-stack references)
+3. Default choices:
+   - Frontend: Next.js 14 + TypeScript + Tailwind
+   - Backend: FastAPI + PostgreSQL + Redis
+   - Mobile: Flutter + Riverpod
+4. Note decision rationale in plan: `tech_decision: { choice: "X", reason: "Y" }`
+
+---
+
+## Serena Memory / Quota Issues
+
+Same as backend-agent playbook: See relevant sections.
+
+---
+
+## General Principles
+
+- **Plans are not code**: They don't need to be perfect. Agents can adjust during execution
+- **Blocked**: If no progress after 5 turns, save current state, `Status: blocked`
+- **No code writing**: PM only plans — delegate implementation to other agents
diff --git a/.agents/skills/pm-agent/resources/examples.md b/.agents/skills/pm-agent/resources/examples.md
new file mode 100644
index 0000000..b84e915
--- /dev/null
+++ b/.agents/skills/pm-agent/resources/examples.md
@@ -0,0 +1,160 @@
+# PM Agent - Examples
+
+## Example 1: Simple TODO App
+
+**Input**: "Build a TODO app with JWT authentication"
+
+**Output**:
+```json
+{
+  "project_name": "TODO App with JWT Auth",
+  "tech_stack": {
+    "frontend": "Next.js 14 + TypeScript + Tailwind",
+    "backend": "FastAPI + PostgreSQL + Redis",
+    "testing": "pytest + Vitest + Playwright"
+  },
+  "tasks": [
+    {
+      "id": "task-1",
+      "agent": "backend",
+      "title": "JWT authentication API",
+      "priority": 1,
+      "dependencies": [],
+      "estimated_complexity": "high",
+      "acceptance_criteria": [
+        "POST /api/auth/register with email + password",
+        "POST /api/auth/login returns access + refresh tokens",
+        "Password hashed with bcrypt",
+        "Rate limiting: 5/min on login"
+      ]
+    },
+    {
+      "id": "task-2",
+      "agent": "backend",
+      "title": "TODO CRUD API",
+      "priority": 1,
+      "dependencies": [],
+      "acceptance_criteria": [
+        "CRUD endpoints for /api/todos",
+        "User-scoped (JWT required)",
+        "Pagination on list endpoint"
+      ]
+    },
+    {
+      "id": "task-3",
+      "agent": "frontend",
+      "title": "Login + Register UI",
+      "priority": 1,
+      "dependencies": [],
+      "acceptance_criteria": [
+        "Login and register forms with validation",
+        "JWT token storage",
+        "Redirect to /todos after login"
+      ]
+    },
+    {
+      "id": "task-4",
+      "agent": "frontend",
+      "title": "TODO List UI",
+      "priority": 2,
+      "dependencies": ["task-2", "task-3"],
+      "acceptance_criteria": [
+        "Add, toggle, delete todos",
+        "Loading and empty states",
+        "Responsive design"
+      ]
+    },
+    {
+      "id": "task-5",
+      "agent": "qa",
+      "title": "Security & Performance Review",
+      "priority": 3,
+      "dependencies": ["task-1", "task-2", "task-3", "task-4"],
+      "acceptance_criteria": [
+        "OWASP Top 10 audit passed",
+        "Lighthouse > 90",
+        "No N+1 queries"
+      ]
+    }
+  ]
+}
+```
+
+## Example 2: Feature Addition to Existing App
+
+**Input**: "Add a comment system to the blog posts"
+
+**Output**:
+```json
+{
+  "project_name": "Blog Comments Feature",
+  "tasks": [
+    {
+      "id": "task-1",
+      "agent": "backend",
+      "title": "Comments API",
+      "priority": 1,
+      "dependencies": [],
+      "acceptance_criteria": [
+        "POST /api/posts/{id}/comments (auth required)",
+        "GET /api/posts/{id}/comments (public, paginated)",
+        "DELETE /api/comments/{id} (owner only)",
+        "Nested replies (1 level deep)"
+      ]
+    },
+    {
+      "id": "task-2",
+      "agent": "frontend",
+      "title": "Comment Section UI",
+      "priority": 2,
+      "dependencies": ["task-1"],
+      "acceptance_criteria": [
+        "Comment list with pagination (load more)",
+        "Add comment form (auth required)",
+        "Reply to comment",
+        "Delete own comment",
+        "Real-time count update"
+      ]
+    }
+  ]
+}
+```
+
+## Example 3: Standards-Aligned Delivery Plan
+
+**Input**: "Plan this enterprise release with risk and governance considerations"
+
+**Output**:
+```json
+{
+  "project_name": "Enterprise Release Plan",
+  "architecture_decisions": [
+    {
+      "decision": "Use phased rollout with feature flags",
+      "rationale": "Reduces operational risk during release",
+      "alternatives_considered": ["big bang release", "tenant-by-tenant rollout"]
+    }
+  ],
+  "project_controls": {
+    "iso_21500": {
+      "scope_defined": true,
+      "stakeholders_identified": ["product", "security", "operations"],
+      "dependencies_mapped": true
+    },
+    "iso_31000": {
+      "top_risks": [
+        "migration rollback failure",
+        "auth regression on legacy users"
+      ],
+      "treatments": [
+        "pre-release restore drill",
+        "shadow auth validation"
+      ]
+    },
+    "iso_38500": {
+      "decision_owner": "engineering manager",
+      "approval_required_for": ["prod migration", "feature-flag enablement"]
+    }
+  }
+}
+```
diff --git a/.agents/skills/pm-agent/resources/execution-protocol.md b/.agents/skills/pm-agent/resources/execution-protocol.md
new file mode 100644
index 0000000..4319775
--- /dev/null
+++ b/.agents/skills/pm-agent/resources/execution-protocol.md
@@ -0,0 +1,57 @@
+# PM Agent - Execution Protocol
+
+## Step 0: Prepare
+1. **Assess difficulty** — see `../_shared/difficulty-guide.md`
+   - **Simple**: Lightweight plan, 3-5 tasks | **Medium**: Full 4 steps | **Complex**: Full + API contracts
+2. **Clarify requirements** — follow `../_shared/clarification-protocol.md` (critical for PM)
+   - Check **Uncertainty Triggers**: business logic, security/auth, existing code conflicts?
+   - Determine level: LOW → proceed | MEDIUM → present options | HIGH → ask immediately
+3. **Use reasoning templates** — for architecture decisions, use `../_shared/reasoning-templates.md` (decision matrix)
+4. **Check lessons** — read cross-domain section in `../_shared/lessons-learned.md`
+5. **If governance, risk, or formal planning matters** — read `resources/iso-planning.md`
+
+**⚠️ Intelligent Escalation**: When uncertain, escalate early. Don't blindly proceed.
+
+Follow these steps in order (adjust depth by difficulty).
+
+## Step 1: Analyze Requirements
+- Parse user request into concrete requirements
+- Identify explicit and implicit features
+- List edge cases and assumptions
+- Ask clarifying questions if ambiguous
+- Use Serena (if existing codebase): `get_symbols_overview` to understand current architecture
+- If risk or governance matters, identify:
+  - stakeholders
+  - constraints
+  - decision owners
+  - major delivery risks
+
+## Step 2: Design Architecture
+- Select tech stack (frontend, backend, mobile, database, infra)
+- Define API contracts (method, path, request/response schema)
+- Design data models (tables, relationships, indexes)
+- Identify security requirements (auth, validation, encryption)
+- Plan infrastructure (hosting, caching, CDN, monitoring)
+- When relevant:
+  - map plan structure to ISO 21500-style project management concepts
+  - record top risks and treatments using ISO 31000-style thinking
+  - note governance, responsibility, and approval needs using ISO 38500-style thinking
+
+## Step 3: Decompose Tasks
+- Break into tasks completable by a single agent
+- Each task has: agent, title, description, acceptance criteria, priority, dependencies
+- Minimize dependencies for maximum parallel execution
+- Priority tiers: 1 = independent (run first), 2 = depends on tier 1, etc.
+- Complexity: Low / Medium / High / Very High
+- Save to `.agents/plan.json` and `.agents/brain/current-plan.md`
+
+## Step 4: Validate Plan
+- Check: Can each task be done independently given its dependencies?
+- Check: Are acceptance criteria measurable and testable?
+- Check: Is security considered from the start (not deferred)?
+- Check: Are API contracts defined before frontend/mobile tasks?
+- Check: Are major risks, owners, and approval points explicit when needed?
+- Output task-board.md format for orchestrator compatibility
+
+## On Error
+See `resources/error-playbook.md` for recovery steps.
diff --git a/.agents/skills/pm-agent/resources/iso-planning.md b/.agents/skills/pm-agent/resources/iso-planning.md
new file mode 100644
index 0000000..0214c87
--- /dev/null
+++ b/.agents/skills/pm-agent/resources/iso-planning.md
@@ -0,0 +1,110 @@
+# PM Agent - ISO 21500 / 31000 / 38500 Guide
+
+Use this file when the user wants standards-based planning, enterprise delivery structure, risk-aware prioritization, or governance-oriented recommendations.
+
+## Positioning
+
+- **ISO 21500**: project management structure and planning lens
+- **ISO 31000**: risk management lens
+- **ISO 38500**: governance, accountability, and decision-rights lens
+
+Do not turn these into ceremony for simple tasks. Use them when they improve clarity, accountability, or delivery confidence.
+
+## 1. ISO 21500 for PM Work
+
+Use ISO 21500 thinking to strengthen:
+
+- scope definition
+- stakeholder identification
+- dependency mapping
+- schedule and sequencing
+- roles and responsibilities
+- deliverable clarity
+
+Practical PM outputs:
+
+- explicit scope and exclusions
+- task decomposition with dependencies
+- owner assignment
+- milestone or phase structure
+- acceptance criteria and deliverables
+
+## 2. ISO 31000 for Risk-Aware Planning
+
+Use ISO 31000 thinking to improve:
+
+- risk identification
+- impact/likelihood discussion
+- prioritization
+- treatment / mitigation planning
+- residual risk visibility
+
+Practical PM outputs:
+
+- top risks list
+- mitigation tasks
+- contingency tasks
+- release blockers vs monitored risks
+- decision points for escalation
+
+## 3. ISO 38500 for Governance
+
+Use ISO 38500 lightly for:
+
+- decision ownership
+- approval boundaries
+- accountability
+- oversight expectations
+- alignment between business intent and technical execution
+
+Practical PM outputs:
+
+- approver or decision owner
+- who must be informed
+- what needs explicit sign-off
+- where governance review is needed
+
+## 4. When to Apply
+
+Apply these standards when:
+
+- the project is enterprise or regulated
+- many teams or stakeholders are involved
+- risk is material
+- decision rights are unclear
+- the user asks for formal planning or governance
+
+Avoid overusing them when:
+
+- the task is a small feature or bug
+- standards language would slow delivery without adding control
+
+## 5. Output Pattern
+
+When relevant, add a short section like:
+
+```md
+## Standards-Aligned Planning Notes
+
+### ISO 21500
+- Scope:
+- Stakeholders:
+- Major dependencies:
+
+### ISO 31000
+- Top risks:
+- Mitigations:
+- Residual risks:
+
+### ISO 38500
+- Decision owner:
+- Required approvals:
+- Governance checkpoints:
+```
+
+## 6. Guardrails
+
+- Keep recommendations actionable, not ceremonial
+- Do not claim formal compliance
+- Tie each standards suggestion to planning, risk reduction, or decision clarity
+- Keep technical execution delegated to specialist agents
diff --git a/.agents/skills/pm-agent/resources/plan-phase-protocol.md b/.agents/skills/pm-agent/resources/plan-phase-protocol.md
new file mode 100644
index 0000000..5d1f4a6
--- /dev/null
+++ b/.agents/skills/pm-agent/resources/plan-phase-protocol.md
@@ -0,0 +1,66 @@
+# PLAN Phase Protocol
+
+Execution guide for PLAN Phase (Steps 1-4) in ultrawork workflow.
+
+---
+
+## Step 1: Create Plan
+
+### Tasks
+- Define scope, features, architecture
+- Apply "Think Before Coding" principle
+- Present alternatives, don't assume
+
+### Outputs
+- Task decomposition (P0/P1/P2 priority)
+- Agent assignments
+- API contracts (if needed)
+
+---
+
+## Step 2: Plan Review (Completeness)
+
+### Review Question
+"Is anything missing?"
+
+### Checklist
+- [ ] All requirements mapped to plan
+- [ ] Dependencies specified
+- [ ] Edge cases considered
+
+---
+
+## Step 3: Review Verification (Meta Review)
+
+### Review Question
+"Was the review done properly?"
+
+### Checklist
+- [ ] Self-verify Step 2 review was sufficient
+- [ ] No review gaps confirmed
+- [ ] No circular logic
+
+---
+
+## Step 4: Over-Engineering Check (Simplicity)
+
+### Review Question
+"Is this over-engineered?"
+
+### Checklist
+- [ ] Asked "Is this needed for MVP?" for each component
+- [ ] Speculative features removed
+- [ ] No "might need later" code
+
+---
+
+## PLAN_GATE Checklist
+
+Final verification before completing plan:
+- [ ] Acceptance criteria defined
+- [ ] Assumptions documented
+- [ ] Alternatives considered (min 2 for major decisions)
+- [ ] Over-engineering review completed
+- [ ] Ready for user confirmation
+
+**Gate failure → Return to Step 1 to revise plan**
diff --git a/.agents/skills/pm-agent/resources/task-template.json b/.agents/skills/pm-agent/resources/task-template.json
new file mode 100644
index 0000000..8034aca
--- /dev/null
+++ b/.agents/skills/pm-agent/resources/task-template.json
@@ -0,0 +1,57 @@
+{
+  "project_name": "",
+  "description": "",
+  "tech_stack": {
+    "frontend": "",
+    "backend": "",
+    "mobile": "",
+    "database": "",
+    "infrastructure": ""
+  },
+  "architecture_decisions": [
+    {
+      "decision": "",
+      "rationale": "",
+      "alternatives_considered": []
+    }
+  ],
+  "tasks": [
+    {
+      "id": "task-1",
+      "agent": "backend|frontend|mobile|qa",
+      "title": "",
+      "description": "",
+      "priority": 1,
+      "dependencies": [],
+      "estimated_complexity": "low|medium|high|very-high",
+      "acceptance_criteria": [],
+      "artifacts_expected": []
+    }
+  ],
+  "api_contracts": [
+    {
+      "endpoint": "",
+      "method": "GET|POST|PUT|DELETE|PATCH",
+      "request": {},
+      "response": {},
+      "headers": {}
+    }
+  ],
+  "data_models": [
+    {
+      "entity": "",
+      "fields": {}
+    }
+  ],
+  "non_functional_requirements": {
+    "security": [],
+    "performance": [],
+    "scalability": []
+  },
+  "testing_strategy": {
+    "unit_tests": "",
+    "integration_tests": "",
+    "e2e_tests": "",
+    "performance_tests": ""
+  }
+}
diff --git a/.agents/skills/qa-agent/SKILL.md b/.agents/skills/qa-agent/SKILL.md
new file mode 100644
index 0000000..e60e2a2
--- /dev/null
+++ b/.agents/skills/qa-agent/SKILL.md
@@ -0,0 +1,48 @@
+---
+name: qa-agent
+description: Quality assurance specialist for security, performance, accessibility, comprehensive testing, and quality standard alignment. Use for test, review, security audit, OWASP, coverage, lint work, and ISO/IEC 25010 or ISO/IEC 29119-aligned QA recommendations.
+---
+
+# QA Agent - Quality Assurance Specialist
+
+## When to use
+- Final review before deployment
+- Security audits (OWASP Top 10)
+- Performance analysis
+- Accessibility compliance (WCAG 2.1 AA)
+- Test coverage analysis
+
+## When NOT to use
+- Initial implementation -> let specialists build first
+- Writing new features -> use domain agents
+
+## Core Rules
+1. Review in priority order: Security > Performance > Accessibility > Code Quality
+2. Every finding must include file:line, description, and fix
+3. Severity: CRITICAL (security breach/data loss), HIGH (blocks launch), MEDIUM (this sprint), LOW (backlog)
+4. Run automated tools first: `npm audit`, `bandit`, `lighthouse`
+5. No false positives - every finding must be reproducible
+6. Provide remediation code, not just descriptions
+7. When relevant, map findings to **ISO/IEC 25010** quality characteristics and propose **ISO/IEC 29119**-aligned test improvements
+
+## How to Execute
+Follow `resources/execution-protocol.md` step by step.
+See `resources/examples.md` for input/output examples.
+Use `resources/iso-quality.md` when the user needs enterprise QA, audit readiness, or standards-based recommendations.
+Before submitting, run `resources/self-check.md`.
+
+## Execution Protocol (CLI Mode)
+
+See `../_shared/execution-protocols/` for vendor-specific protocols.
+When spawned via `oh-my-ag agent:spawn`, the protocol is injected automatically.
+
+## References
+- Execution steps: `resources/execution-protocol.md`
+- Report examples: `resources/examples.md`
+- ISO quality guide: `resources/iso-quality.md`
+- QA checklist: `resources/checklist.md`
+- Self-check: `resources/self-check.md`
+- Error recovery: `resources/error-playbook.md`
+- Context loading: `../_shared/context-loading.md`
+- Context budget: `../_shared/context-budget.md`
+- Lessons learned: `../_shared/lessons-learned.md`
diff --git a/.agents/skills/qa-agent/resources/checklist.md b/.agents/skills/qa-agent/resources/checklist.md
new file mode 100644
index 0000000..707b6d3
--- /dev/null
+++ b/.agents/skills/qa-agent/resources/checklist.md
@@ -0,0 +1,320 @@
+# QA Review Checklist
+
+## Security Checklist
+
+### Authentication & Authorization
+- [ ] Passwords hashed with bcrypt/argon2 (not MD5/SHA1)
+- [ ] Password strength requirements enforced (min 8 chars)
+- [ ] JWT tokens properly signed and validated
+- [ ] Refresh tokens implemented (if long sessions needed)
+- [ ] Token expiry reasonable (15min access, 7day refresh)
+- [ ] Authorization checks on ALL endpoints
+- [ ] Users can only access their own data
+- [ ] Admin functions require admin role
+- [ ] Rate limiting on auth endpoints (5-10 attempts/min)
+- [ ] Account lockout after failed login attempts (optional)
+- [ ] MFA available (optional, but recommended)
+
+### Input Validation & Injection
+- [ ] SQL injection: ORM used OR parameterized queries
+- [ ] XSS: Input sanitized, CSP headers set
+- [ ] Command injection: No shell execution with user input
+- [ ] Path traversal: File paths validated
+- [ ] LDAP injection: LDAP queries parameterized
+- [ ] XML injection: XML parsing secure
+- [ ] Email validation (proper regex/library)
+- [ ] URL validation (allowlist for external requests)
+
+### Data Protection
+- [ ] HTTPS enforced (redirect HTTP to HTTPS)
+- [ ] Sensitive data NOT in logs
+- [ ] Sensitive data NOT in error messages
+- [ ] Sensitive data NOT in URLs (use POST body)
+- [ ] Database backups encrypted
+- [ ] PII data encrypted at rest (if applicable)
+- [ ] Secure session management (httpOnly, secure, sameSite cookies)
+
+### API Security
+- [ ] CORS properly configured (not `*` in production)
+- [ ] CSRF protection enabled
+- [ ] Rate limiting on API endpoints
+- [ ] API keys/tokens NOT in source code
+- [ ] API versioning implemented
+- [ ] Proper error handling (no stack traces exposed)
+
+### Dependencies
+- [ ] No high/critical vulnerabilities (npm audit / safety check)
+- [ ] Dependencies up-to-date
+- [ ] No unused dependencies
+- [ ] License compliance checked
+
+---
+
+## Performance Checklist
+
+### Backend Performance
+- [ ] API response time < 200ms (p95)
+- [ ] Database queries optimized (no N+1)
+- [ ] Database indexes on foreign keys and frequent queries
+- [ ] Connection pooling configured
+- [ ] Caching implemented (Redis for frequent queries)
+- [ ] Pagination for large result sets
+- [ ] Async operations where appropriate
+- [ ] Background jobs for heavy tasks
+
+### Frontend Performance
+- [ ] Lighthouse Performance score > 90
+- [ ] First Contentful Paint (FCP) < 1.5s
+- [ ] Largest Contentful Paint (LCP) < 2.5s
+- [ ] Cumulative Layout Shift (CLS) < 0.1
+- [ ] Time to Interactive (TTI) < 3.5s
+- [ ] Bundle size < 500KB (main bundle)
+- [ ] Code splitting implemented
+- [ ] Lazy loading for non-critical components
+- [ ] Images optimized (WebP, compression)
+- [ ] Images lazy loaded (loading="lazy")
+- [ ] Fonts optimized (font-display: swap)
+- [ ] No render-blocking resources
+- [ ] Service worker for caching (optional)
+
+### Mobile Performance
+- [ ] App size < 30MB (Android), < 50MB (iOS)
+- [ ] Cold start < 2s
+- [ ] Smooth scrolling (60fps)
+- [ ] No memory leaks
+- [ ] Battery usage minimal
+- [ ] Offline support (if required)
+
+---
+
+## Accessibility Checklist (WCAG 2.1 AA)
+
+### Perceivable
+- [ ] All images have alt text
+- [ ] Decorative images have empty alt (`alt=""`)
+- [ ] Color contrast 4.5:1 (normal text), 3:1 (large text)
+- [ ] Text resizable up to 200% without loss of content
+- [ ] Content understandable without color alone
+- [ ] Audio/video has captions (if applicable)
+
+### Operable
+- [ ] All functionality available via keyboard
+- [ ] No keyboard trap
+- [ ] Focus order is logical
+- [ ] Focus indicators visible
+- [ ] Skip to main content link
+- [ ] No content flashes more than 3 times per second
+- [ ] Enough time to read/interact with content
+- [ ] Pause/stop for moving content
+
+### Understandable
+- [ ] Page language set (`<html lang="en">`)
+- [ ] Clear labels on form inputs
+- [ ] Error messages clear and helpful
+- [ ] Required fields indicated
+- [ ] Consistent navigation across pages
+- [ ] Predictable behavior (no unexpected popups)
+
+### Robust
+- [ ] Valid HTML (semantic tags)
+- [ ] ARIA labels where needed
+- [ ] ARIA roles appropriate
+- [ ] Works with screen readers (test with NVDA/JAWS)
+- [ ] Works in different browsers (Chrome, Firefox, Safari, Edge)
+
+---
+
+## Testing Checklist
+
+### Unit Tests
+- [ ] Test coverage > 80%
+- [ ] All business logic functions tested
+- [ ] Edge cases covered
+- [ ] Error handling tested
+- [ ] Mocks used appropriately
+- [ ] Tests run fast (< 10s total)
+- [ ] No flaky tests
+
+### Integration Tests
+- [ ] All API endpoints tested
+- [ ] Database operations tested
+- [ ] Auth flow tested
+- [ ] Error responses tested (401, 403, 404, 500)
+- [ ] Request validation tested
+
+### E2E Tests
+- [ ] Critical user flows tested (registration, login, main feature)
+- [ ] Happy path tested
+- [ ] Error scenarios tested
+- [ ] Mobile responsive tested
+- [ ] Cross-browser tested (Chrome, Firefox, Safari)
+
+### Test Governance
+- [ ] Test levels and scope are defined clearly
+- [ ] Important requirements trace to test cases or test scenarios
+- [ ] Entry / exit criteria are defined for major release decisions
+- [ ] Test design technique is appropriate for risk and feature type
+
+### Performance Tests
+- [ ] Load testing (1000 concurrent users)
+- [ ] Stress testing (identify breaking point)
+- [ ] Database under load tested
+- [ ] API rate limits tested
+
+---
+
+## Code Quality Checklist
+
+### Architecture
+- [ ] Clear separation of concerns
+- [ ] DRY principle followed (no duplication > 5%)
+- [ ] SOLID principles followed
+- [ ] Dependency injection used
+- [ ] Repository pattern (backend)
+- [ ] Component composition (frontend)
+
+### Code Metrics
+- [ ] Cyclomatic complexity < 10 per function
+- [ ] Function length < 50 lines
+- [ ] File length < 500 lines
+- [ ] No deeply nested code (< 4 levels)
+- [ ] Meaningful variable names
+
+### Error Handling
+- [ ] All async operations have try/catch
+- [ ] Errors logged appropriately
+- [ ] User-friendly error messages
+- [ ] No silent failures
+- [ ] Graceful degradation
+
+### Documentation
+- [ ] README with setup instructions
+- [ ] API documentation (OpenAPI/Swagger)
+- [ ] Complex logic documented
+- [ ] Environment variables documented
+- [ ] No TODO/FIXME in production code
+
+---
+
+## ISO Quality Alignment
+
+### ISO/IEC 25010
+- [ ] Functional suitability considered
+- [ ] Performance efficiency considered
+- [ ] Compatibility considered where integration matters
+- [ ] Usability / accessibility considered
+- [ ] Reliability considered
+- [ ] Security considered
+- [ ] Maintainability considered
+- [ ] Portability considered when relevant
+
+### ISO/IEC 29119
+- [ ] Test strategy or test plan exists for significant changes
+- [ ] Test basis, test conditions, and expected results are clear
+- [ ] Risk-based prioritization is visible in test scope
+- [ ] Test evidence and traceability are sufficient for review or audit
+
+---
+
+## Browser Compatibility Checklist
+
+### Desktop
+- [ ] Chrome (latest 2 versions)
+- [ ] Firefox (latest 2 versions)
+- [ ] Safari (latest 2 versions)
+- [ ] Edge (latest 2 versions)
+
+### Mobile
+- [ ] iOS Safari (latest 2 versions)
+- [ ] Android Chrome (latest 2 versions)
+- [ ] Responsive breakpoints (320px, 768px, 1024px, 1440px)
+
+---
+
+## DevOps Checklist
+
+### Environment
+- [ ] Environment variables used (not hardcoded)
+- [ ] .env.example provided
+- [ ] Secrets NOT in source code
+- [ ] Different configs for dev/staging/prod
+
+### Logging
+- [ ] Appropriate log levels (DEBUG, INFO, WARNING, ERROR)
+- [ ] No sensitive data in logs
+- [ ] Structured logging (JSON format)
+- [ ] Log rotation configured
+
+### Monitoring
+- [ ] Health check endpoint (`/health`)
+- [ ] Error tracking (Sentry, Rollbar, etc.)
+- [ ] Performance monitoring (APM)
+- [ ] Uptime monitoring
+
+### Deployment
+- [ ] CI/CD pipeline configured
+- [ ] Automated tests in CI
+- [ ] Database migrations automated
+- [ ] Rollback plan documented
+- [ ] Zero-downtime deployment (if required)
+
+---
+
+## Final Sign-Off
+
+### Critical (Must Pass)
+- [ ] No CRITICAL security vulnerabilities
+- [ ] No HIGH security vulnerabilities
+- [ ] All E2E tests passing
+- [ ] Performance meets requirements
+- [ ] No data loss scenarios
+
+### Important (Should Pass)
+- [ ] Test coverage > 80%
+- [ ] Accessibility WCAG 2.1 AA
+- [ ] Code quality metrics met
+- [ ] Documentation complete
+
+### Nice-to-Have (Can Address Later)
+- [ ] Code refactoring opportunities documented
+- [ ] Performance optimization ideas documented
+- [ ] Future enhancement ideas documented
+
+---
+
+## Issue Prioritization
+
+### 🔴 CRITICAL (Block Deployment)
+- Security vulnerabilities (SQL injection, XSS, auth bypass)
+- Data loss bugs
+- Application crashes
+- Complete feature breakage
+
+### 🟠 HIGH (Fix Before Launch)
+- Performance issues (> 5s load time)
+- Major accessibility violations
+- Missing auth checks
+- Broken core functionality
+
+### 🟡 MEDIUM (Fix in Sprint)
+- Minor bugs
+- Code quality issues
+- Missing tests
+- Minor accessibility issues
+
+### 🔵 LOW (Backlog)
+- Refactoring opportunities
+- Performance optimizations
+- Nice-to-have features
+- Documentation improvements
+
+---
+
+## Notes
+
+- Run automated tools FIRST: `npm audit`, `bandit`, `lighthouse`
+- Use Serena MCP for code analysis patterns
+- Use Antigravity Browser for E2E testing
+- Document all findings with file:line references
+- Provide remediation code examples
+- Estimate fix time for each issue
diff --git a/.agents/skills/qa-agent/resources/error-playbook.md b/.agents/skills/qa-agent/resources/error-playbook.md
new file mode 100644
index 0000000..f357cbb
--- /dev/null
+++ b/.agents/skills/qa-agent/resources/error-playbook.md
@@ -0,0 +1,95 @@
+# QA Agent - Error Recovery Playbook
+
+When you encounter a failure during review, follow these recovery steps.
+Do NOT stop or ask for help until you have exhausted the playbook.
+
+---
+
+## Automated Tool Fails to Run
+
+**Symptoms**: `npm audit`, `bandit`, `lighthouse` command errors
+
+1. Check: is the tool installed? Note missing tool in result
+2. Check: are you in the correct directory?
+3. If `npm audit`: try `npm audit --production` to skip devDependencies
+4. If `bandit`: check Python path — may need `python -m bandit`
+5. If `lighthouse`: requires a running server — note if server not available
+6. **If tool unavailable**: Fall back to manual review, record `tool_unavailable: ["tool_name"]` in result
+
+---
+
+## False Positive Suspected
+
+**Symptoms**: Finding looks like a vulnerability but might be safe
+
+1. Trace the data flow — does user input actually reach the dangerous operation?
+2. Check: is there validation/sanitization upstream?
+3. Check: is the framework handling this automatically? (e.g., ORM prevents SQL injection)
+4. If uncertain: mark severity as `MEDIUM` with note "verify manually"
+5. **NEVER do this**: Mark as CRITICAL without certainty — false alarms erode trust
+
+---
+
+## Cannot Access Source Code
+
+**Symptoms**: Serena `find_symbol` returns nothing, file not found
+
+1. Check: correct file path? Use `search_for_pattern` with broader terms
+2. Check: is the code in a different directory or monorepo?
+3. Use `get_symbols_overview` on parent directories to find the structure
+4. If truly inaccessible: review what you CAN access and note gaps in report
+
+---
+
+## Performance Metrics Unavailable
+
+**Symptoms**: Can't run Lighthouse, no APM data, no load test results
+
+1. Check if dev server is running for Lighthouse
+2. If no server: review code statically for performance anti-patterns:
+   - N+1 queries (loops with DB calls)
+   - Missing pagination
+   - Large bundle imports
+   - No code splitting
+3. Report findings with `static_analysis_only: true` flag
+4. Recommend specific metrics to measure when environment is available
+
+---
+
+## Scope Too Large
+
+**Symptoms**: Full audit requested but codebase has 100+ files
+
+1. Prioritize: auth/security-critical files first
+2. Use pattern search to find high-risk areas:
+   - `search_for_pattern("password|secret|token|api_key")`
+   - `search_for_pattern("execute|eval|innerHTML")`
+3. Review critical paths: auth flow, payment, data mutation
+4. Note in report: `scope_coverage: "critical paths only, full audit requires more"`
+
+---
+
+## Rate Limit / Quota Error
+
+**Symptoms**: `429`, `RESOURCE_EXHAUSTED`, `rate limit exceeded`
+
+1. **Stop immediately** — do not make additional API calls
+2. Save current work to `progress-{agent-id}.md`
+3. Record Status: `quota_exceeded` in `result-{agent-id}.md`
+4. Specify remaining tasks
+
+---
+
+## Serena Memory Unavailable
+
+1. Retry once
+2. If 2 consecutive failures: use local file `/tmp/progress-{agent-id}.md`
+3. Add `memory_fallback: true` flag to result
+
+---
+
+## General Principles
+
+- **False positive prevention**: If finding is uncertain, lower severity and mark "verify manually"
+- **Blocked**: If no progress after 5 turns, save current state, `Status: blocked`
+- **No code modification**: QA only reports — delegate code changes to the appropriate agent
diff --git a/.agents/skills/qa-agent/resources/examples.md b/.agents/skills/qa-agent/resources/examples.md
new file mode 100644
index 0000000..56ace37
--- /dev/null
+++ b/.agents/skills/qa-agent/resources/examples.md
@@ -0,0 +1,127 @@
+# QA Agent - Examples
+
+## Example 1: Security Audit
+
+**Input**: "Review the authentication system for security issues"
+
+**Output**:
+```
+# QA Report: Authentication System
+Status: FAIL
+
+## Security Audit
+
+### CRITICAL
+1. **SQL Injection** - backend/api/users.py:45
+   - Raw string interpolation in query
+   - Fix: Use parameterized query or ORM
+
+2. **Missing Rate Limiting** - backend/api/auth.py:23
+   - Login endpoint has no rate limiting
+   - Fix: Add @limiter.limit("5/minute")
+
+### Passed
+- [x] Passwords hashed with bcrypt (cost 12)
+- [x] JWT properly signed with RS256
+- [x] Refresh token rotation implemented
+- [x] CORS configured (not wildcard)
+
+## Recommendations
+### High Priority (Before Launch)
+1. Fix SQL injection in users.py:45
+2. Add rate limiting to auth endpoints
+3. Add account lockout after 10 failed attempts
+```
+
+## Example 2: Performance Review
+
+**Input**: "Check frontend performance - users report slow load times"
+
+**Output**:
+```
+# QA Report: Frontend Performance
+Status: WARNING
+
+## Performance
+- Lighthouse Score: 67/100 [FAIL - Target > 90]
+- FCP: 2.8s [FAIL - Target < 1.5s]
+- LCP: 4.1s [FAIL - Target < 2.5s]
+- Bundle: 1.2MB [FAIL - Target < 500KB]
+- CLS: 0.05 [PASS]
+
+## Root Causes
+1. Full lodash import (72KB) - src/utils/helpers.ts:1
+2. No code splitting on routes - src/app/layout.tsx
+3. Unoptimized images (3 x 2MB PNGs) - public/images/
+
+## Recommendations
+### High Priority
+1. Tree-shake lodash: `import uniq from 'lodash/uniq'`
+2. Add dynamic imports: `const Page = dynamic(() => import(...))`
+3. Convert images to WebP, add width/height, loading="lazy"
+
+### Expected After Fix
+- Bundle: ~350KB (-70%)
+- FCP: ~1.2s
+- Lighthouse: ~92
+```
+
+## Example 3: Full Pre-Launch Audit
+
+**Input**: "Complete QA review before production deployment"
+
+**Output**:
+```
+# QA Report: Pre-Launch Audit
+Status: WARNING
+
+## Summary
+- Security: 0 CRITICAL, 1 HIGH, 2 MEDIUM
+- Performance: PASS (all targets met)
+- Accessibility: 1 HIGH, 3 MEDIUM
+- Test Coverage: 83% [PASS]
+
+## High Priority (Block Launch)
+1. [SECURITY-HIGH] Missing CSRF protection on POST endpoints
+2. [A11Y-HIGH] Login form has no aria-labels
+
+## Medium Priority (Fix This Sprint)
+1. [SECURITY-MED] API error responses expose stack traces
+2. [SECURITY-MED] No Content-Security-Policy header
+3. [A11Y-MED] Color contrast 3.8:1 on secondary text (need 4.5:1)
+4. [A11Y-MED] Missing skip-to-content link
+5. [A11Y-MED] Focus indicator invisible on dark theme
+
+## Sign-Off
+- [x] No CRITICAL vulnerabilities
+- [ ] No HIGH vulnerabilities (2 remaining)
+- [x] Performance targets met
+- [x] Test coverage > 80%
+```
+
+## Example 4: Standards-Aligned QA Review
+
+**Input**: "Review this release candidate and suggest ISO 25010 / 29119 improvements"
+
+**Output**:
+```
+# QA Report: Release Candidate
+Status: WARNING
+
+## Standards Alignment
+
+### ISO/IEC 25010
+- Reliability gap: no chaos/failure-path validation for retry flows
+- Maintainability gap: business rules duplicated in 3 services
+- Security gap: privileged actions are not audit-logged consistently
+
+### ISO/IEC 29119
+- Missing requirement-to-test traceability for payment cancellation
+- No explicit exit criteria for regression approval
+- Edge-case test design is weak for invalid state transitions
+
+## Recommendations
+1. Add requirement-to-test mapping for payment, refund, and auth flows
+2. Define release exit criteria: zero HIGH findings, all critical E2E paths green
+3. Add state-transition and boundary-value tests for payment lifecycle
+```
diff --git a/.agents/skills/qa-agent/resources/execution-protocol.md b/.agents/skills/qa-agent/resources/execution-protocol.md
new file mode 100644
index 0000000..6942c15
--- /dev/null
+++ b/.agents/skills/qa-agent/resources/execution-protocol.md
@@ -0,0 +1,58 @@
+# QA Agent - Execution Protocol
+
+## Step 0: Prepare
+1. **Assess difficulty** — see `../_shared/difficulty-guide.md`
+   - **Simple**: Quick security + quality check | **Medium**: Full 4 steps | **Complex**: Full + prioritized scope
+2. **Check lessons** — read QA section in `../_shared/lessons-learned.md`
+3. **Clarify requirements** — follow `../_shared/clarification-protocol.md`
+   - Check **Uncertainty Triggers**: security/auth concerns, existing code conflict potential?
+   - Determine level: LOW → proceed | MEDIUM → present options | HIGH → ask immediately
+4. **Budget context** — follow `../_shared/context-budget.md` (prioritize high-risk files)
+5. **After review**: add recurring issues to `../_shared/lessons-learned.md`
+6. **If standards matter**: read `resources/iso-quality.md`
+
+**⚠️ Intelligent Escalation**: When uncertain, escalate early. Don't blindly proceed.
+
+Follow these steps in order (adjust depth by difficulty).
+
+## Step 1: Scope
+- Identify what to review: new feature, full audit, or specific concern
+- List all files/modules to inspect
+- Determine review depth: quick check vs. comprehensive audit
+- Use Serena to map the codebase:
+  - `get_symbols_overview("src/")`: Understand structure
+  - `search_for_pattern("password.*=.*[\"']")`: Find hardcoded secrets
+  - `search_for_pattern("execute.*\\$\\{")`: Find SQL injection
+  - `search_for_pattern("innerHTML")`: Find XSS vulnerabilities
+
+## Step 2: Audit
+Review in this priority order:
+1. **Security** (CRITICAL): OWASP Top 10, auth, injection, data protection
+2. **Performance**: API latency, N+1 queries, bundle size, Core Web Vitals
+3. **Accessibility**: WCAG 2.1 AA, keyboard nav, screen reader, contrast
+4. **Code Quality**: test coverage, complexity, architecture adherence
+
+When applicable, map findings and gaps to:
+- **ISO/IEC 25010** quality characteristics
+- **ISO/IEC 29119** test planning, design, traceability, and exit criteria
+
+Use `resources/checklist.md` (renamed qa-checklist) as the comprehensive review guide.
+
+## Step 3: Report
+Generate structured report with:
+- Overall status: PASS / WARNING / FAIL
+- Findings grouped by severity (CRITICAL > HIGH > MEDIUM > LOW)
+- Each finding: file:line, description, remediation code
+- Performance metrics vs. targets
+- Standards suggestions when relevant:
+  - quality characteristics under-covered
+  - missing test design / traceability / exit criteria
+
+## Step 4: Verify
+- Run `resources/self-check.md` to verify your own review quality
+- Ensure no false positives (each finding is real and reproducible)
+- Confirm remediation suggestions are correct and complete
+- Run `../_shared/common-checklist.md` for general quality
+
+## On Error
+See `resources/error-playbook.md` for recovery steps.
diff --git a/.agents/skills/qa-agent/resources/iso-quality.md b/.agents/skills/qa-agent/resources/iso-quality.md
new file mode 100644
index 0000000..623ddd5
--- /dev/null
+++ b/.agents/skills/qa-agent/resources/iso-quality.md
@@ -0,0 +1,82 @@
+# QA Agent - ISO Quality Guide
+
+Use this file when the user asks for standards-based QA suggestions, enterprise audit readiness, or process-oriented quality improvements.
+
+## Positioning
+
+- Use **ISO/IEC 25010** as the practical software quality model.
+- Treat **ISO/IEC 25010** as part of the **ISO/IEC 25000 SQuaRE family** when users say "ISO 25000".
+- Use **ISO/IEC 29119** for test process, test design, traceability, and evidence recommendations.
+- Do not force standards language into every QA review. Add it when it improves decision quality, auditability, or delivery discipline.
+
+## 1. ISO/IEC 25010 Mapping
+
+Map findings to these quality characteristics when relevant:
+
+- functional suitability
+- performance efficiency
+- compatibility
+- usability
+- reliability
+- security
+- maintainability
+- portability
+
+Use this mapping to answer:
+
+- Which quality areas are under-covered?
+- Which areas are blocking release confidence?
+- Which missing tests leave important quality characteristics unverified?
+
+## 2. ISO/IEC 29119 Suggestions
+
+Recommend these when test discipline is weak:
+
+- test strategy or test plan
+- test levels and scope definition
+- requirement / risk to test traceability
+- explicit test conditions and expected results
+- risk-based prioritization
+- entry / exit criteria
+- evidence retention for review or audit
+
+## 3. When to Mention Standards
+
+Mention ISO alignment when:
+
+- the user asks for audit readiness
+- the work is enterprise or regulated
+- release governance is unclear
+- testing exists but lacks structure or traceability
+- quality discussion is too vague and needs a common model
+
+Avoid overusing standards language when:
+
+- the task is a quick bug fix
+- the user wants only concrete defects
+- standards language would add ceremony without action
+
+## 4. Review Output Pattern
+
+If standards are relevant, add a short section:
+
+```md
+## Standards Alignment
+
+### ISO/IEC 25010
+- Quality characteristic:
+- Gap:
+- Recommendation:
+
+### ISO/IEC 29119
+- Test governance gap:
+- Traceability / evidence gap:
+- Recommendation:
+```
+
+## 5. Guardrails
+
+- Prefer practical suggestions over compliance theater
+- Do not claim formal compliance unless evidence exists
+- Tie every standards suggestion to a delivery, test, or risk outcome
+- Keep standards comments secondary to concrete findings
diff --git a/.agents/skills/qa-agent/resources/self-check.md b/.agents/skills/qa-agent/resources/self-check.md
new file mode 100644
index 0000000..0b68915
--- /dev/null
+++ b/.agents/skills/qa-agent/resources/self-check.md
@@ -0,0 +1,29 @@
+# QA Agent - Self-Check
+
+Verify your own review quality before submitting the QA report.
+
+## Completeness
+- [ ] All files in scope were reviewed (none skipped)
+- [ ] Security section covers OWASP Top 10 categories
+- [ ] Performance metrics include actual numbers vs. targets
+- [ ] Accessibility check covers Perceivable, Operable, Understandable, Robust
+- [ ] ISO/IEC 25010 and ISO/IEC 29119 suggestions were included when relevant
+
+## Accuracy
+- [ ] Every finding includes file path and line number
+- [ ] Every finding is reproducible (not speculative)
+- [ ] No false positives (double-check edge cases)
+- [ ] Severity ratings are consistent (CRITICAL = data loss/security breach)
+
+## Actionability
+- [ ] Every finding has a specific remediation step
+- [ ] Remediation code examples are correct and complete
+- [ ] Priorities are clearly ordered (what to fix first)
+- [ ] Estimated impact is noted for performance issues
+- [ ] Standards-based suggestions are practical, not ceremonial
+
+## Report Quality
+- [ ] Overall status (PASS/WARNING/FAIL) matches findings
+- [ ] Report is scannable (headers, bullets, status tags)
+- [ ] No duplicate findings
+- [ ] Sign-off checklist included for launch decisions
diff --git a/.agents/skills/qa-agent/resources/verify-ship-protocol.md b/.agents/skills/qa-agent/resources/verify-ship-protocol.md
new file mode 100644
index 0000000..49188af
--- /dev/null
+++ b/.agents/skills/qa-agent/resources/verify-ship-protocol.md
@@ -0,0 +1,116 @@
+# VERIFY/SHIP Phase Protocol
+
+Execution guide for VERIFY Phase (Steps 6-8) and SHIP Phase (Steps 14-17) in ultrawork workflow.
+
+---
+
+## VERIFY Phase (Steps 6-8)
+
+### Step 6: Alignment Review
+
+**Review Question**: "Did we build what was requested?"
+
+- [ ] Plan vs implementation 1:1 comparison
+- [ ] Misalignments documented
+- [ ] No missing features
+
+---
+
+### Step 7: Security/Bug Review
+
+**Review Question**: "Is there anything dangerous?"
+
+**Automated Tools:**
+- `npm audit` (Node.js)
+- `bandit` (Python)
+- `lighthouse` (web performance)
+
+**OWASP Top 10 Check:**
+- [ ] No injection vulnerabilities
+- [ ] No authentication flaws
+- [ ] No sensitive data exposure
+- [ ] No XXE vulnerabilities
+- [ ] No access control flaws
+
+**Finding Format:**
+- File:line
+- Description
+- Severity (CRITICAL/HIGH/MEDIUM/LOW)
+- Fix suggestion
+
+---
+
+### Step 8: Improvement Review
+
+**Review Question**: "Did improvements break anything?"
+
+- [ ] All existing tests pass
+- [ ] Existing features work normally
+- [ ] New code matches existing patterns
+
+---
+
+### VERIFY_GATE Checklist
+
+- [ ] Implementation = Requirements
+- [ ] CRITICAL issues: 0
+- [ ] HIGH issues: 0
+- [ ] No regressions
+
+**Gate failure → Return to Step 5 (fix implementation)**
+
+---
+
+## SHIP Phase (Steps 14-17)
+
+### Step 14: Code Quality Review
+
+**Review Question**: "Does it meet quality standards?"
+
+- [ ] lint passes
+- [ ] type check passes
+- [ ] test coverage >= 80%
+- [ ] `_shared/common-checklist.md` passes
+
+---
+
+### Step 15: UX Flow Verification
+
+- [ ] End-to-end user journey test
+- [ ] Error states verified
+- [ ] Loading states verified
+- [ ] Accessibility compliance (WCAG 2.1 AA)
+
+---
+
+### Step 16: Related Issues Review
+
+**Review Question**: "Did we break anything elsewhere?"
+
+- [ ] Issues discovered during review checked
+- [ ] Related areas not broken
+- [ ] Deferred items documented (next sprint)
+
+---
+
+### Step 17: Deployment Readiness Review
+
+**Review Question**: "Is this ready to deploy?"
+
+- [ ] No hardcoded secrets
+- [ ] Environment variables documented
+- [ ] Migrations safe
+- [ ] Rollback possible
+- [ ] Monitoring ready
+
+---
+
+### SHIP_GATE Checklist
+
+- [ ] All quality checks pass
+- [ ] UX verified
+- [ ] Related issues resolved
+- [ ] Deployment checklist complete
+- [ ] **User final approval**
+
+**Gate failure → Return to appropriate phase based on failure type**
diff --git a/.agents/skills/react-best-practices/AGENTS.md b/.agents/skills/react-best-practices/AGENTS.md
deleted file mode 100644
index 3c6bce1..0000000
--- a/.agents/skills/react-best-practices/AGENTS.md
+++ /dev/null
@@ -1,2040 +0,0 @@
-# React Best Practices
-
-**Version 2.0.0**  
-gracefullight (forked from Vercel Engineering)  
-January 2026
-
-> **Note:**  
-> This document is mainly for agents and LLMs to follow when maintaining,  
-> generating, or refactoring React and Next.js codebases. Humans  
-> may also find it useful, but guidance here is optimized for automation  
-> and consistency by AI-assisted workflows.
-
----
-
-## Abstract
-
-Comprehensive performance optimization guide for React and Next.js applications, designed for AI agents and LLMs. Contains 42 rules across 8 categories (some rules are enforced by Biome linter), prioritized by impact from critical (eliminating waterfalls, reducing bundle size) to incremental (advanced patterns). Each rule includes detailed explanations, real-world examples comparing incorrect vs. correct implementations, and specific impact metrics to guide automated refactoring and code generation.
-
----
-
-## Table of Contents
-
-1. [Eliminating Waterfalls](#1-eliminating-waterfalls) — **CRITICAL**
-   - 1.1 [Defer Await Until Needed](#11-defer-await-until-needed)
-   - 1.2 [Dependency-Based Parallelization](#12-dependency-based-parallelization)
-   - 1.3 [Prevent Waterfall Chains in API Routes](#13-prevent-waterfall-chains-in-api-routes)
-   - 1.4 [Promise.all() for Independent Operations](#14-promiseall-for-independent-operations)
-   - 1.5 [Strategic Suspense Boundaries](#15-strategic-suspense-boundaries)
-2. [Bundle Size Optimization](#2-bundle-size-optimization) — **CRITICAL**
-   - 2.1 [Conditional Module Loading](#21-conditional-module-loading)
-   - 2.2 [Defer Non-Critical Third-Party Libraries](#22-defer-non-critical-third-party-libraries)
-   - 2.3 [Dynamic Imports for Heavy Components](#23-dynamic-imports-for-heavy-components)
-   - 2.4 [Preload Based on User Intent](#24-preload-based-on-user-intent)
-3. [Server-Side Performance](#3-server-side-performance) — **HIGH**
-   - 3.1 [Use after() for Non-Blocking Operations](#31-use-after-for-non-blocking-operations)
-4. [Client-Side Data Fetching](#4-client-side-data-fetching) — **MEDIUM-HIGH**
-   - 4.1 [Use React Compiler Optimal](#41-use-react-compiler-optimal)
-   - 4.2 [Use Orval-Generated Hooks for API Data Fetching](#42-use-orval-generated-hooks-for-api-data-fetching)
-   - 4.3 [Use @tanstack/query for Automatic Deduplication](#43-use-tanstackquery-for-automatic-deduplication)
-   - 4.4 [Deduplicate Global Event Listeners](#44-deduplicate-global-event-listeners)
-5. [Re-render Optimization](#5-re-render-optimization) — **MEDIUM**
-   - 5.1 [Defer State Reads to Usage Point](#51-defer-state-reads-to-usage-point)
-   - 5.2 [Extract to Memoized Components](#52-extract-to-memoized-components)
-   - 5.3 [Narrow Effect Dependencies](#53-narrow-effect-dependencies)
-   - 5.4 [Subscribe to Derived State](#54-subscribe-to-derived-state)
-   - 5.5 [Use Functional setState Updates](#55-use-functional-setstate-updates)
-   - 5.6 [Use Lazy State Initialization](#56-use-lazy-state-initialization)
-   - 5.7 [Use Transitions for Non-Urgent Updates](#57-use-transitions-for-non-urgent-updates)
-6. [Rendering Performance](#6-rendering-performance) — **MEDIUM**
-   - 6.1 [Animate SVG Wrapper Instead of SVG Element](#61-animate-svg-wrapper-instead-of-svg-element)
-   - 6.2 [CSS content-visibility for Long Lists](#62-css-content-visibility-for-long-lists)
-   - 6.3 [Hoist Static JSX Elements](#63-hoist-static-jsx-elements)
-   - 6.4 [Optimize SVG Precision](#64-optimize-svg-precision)
-   - 6.5 [Prevent Hydration Mismatch Without Flickering](#65-prevent-hydration-mismatch-without-flickering)
-   - 6.6 [Use Activity Component for Show/Hide](#66-use-activity-component-for-showhide)
-7. [JavaScript Performance](#7-javascript-performance) — **LOW-MEDIUM**
-   - 7.1 [Batch DOM CSS Changes](#71-batch-dom-css-changes)
-   - 7.2 [Build Index Maps for Repeated Lookups](#72-build-index-maps-for-repeated-lookups)
-   - 7.3 [Cache Property Access in Loops](#73-cache-property-access-in-loops)
-   - 7.4 [Cache Repeated Function Calls](#74-cache-repeated-function-calls)
-   - 7.5 [Cache Storage API Calls](#75-cache-storage-api-calls)
-   - 7.6 [Combine Multiple Array Iterations](#76-combine-multiple-array-iterations)
-   - 7.7 [Early Length Check for Array Comparisons](#77-early-length-check-for-array-comparisons)
-   - 7.8 [Early Return from Functions](#78-early-return-from-functions)
-   - 7.9 [Use Loop for Min/Max Instead of Sort](#79-use-loop-for-minmax-instead-of-sort)
-   - 7.10 [Use Set/Map for O(1) Lookups](#710-use-setmap-for-o1-lookups)
-   - 7.11 [Use toSorted() Instead of sort() for Immutability](#711-use-tosorted-instead-of-sort-for-immutability)
-8. [Advanced Patterns](#8-advanced-patterns) — **LOW**
-   - 8.1 [Store Event Handlers in Refs](#81-store-event-handlers-in-refs)
-   - 8.2 [useLatest for Stable Callback Refs](#82-uselatest-for-stable-callback-refs)
-
----
-
-## 1. Eliminating Waterfalls
-
-**Impact: CRITICAL**
-
-Waterfalls are the #1 performance killer. Each sequential await adds full network latency. Eliminating them yields the largest gains.
-
-### 1.1 Defer Await Until Needed
-
-**Impact: HIGH (avoids blocking unused code paths)**
-
-Move `await` operations into the branches where they're actually used to avoid blocking code paths that don't need them.
-
-**Incorrect: blocks both branches**
-
-```typescript
-async function handleRequest(userId: string, skipProcessing: boolean) {
-  const userData = await fetchUserData(userId)
-  
-  if (skipProcessing) {
-    // Returns immediately but still waited for userData
-    return { skipped: true }
-  }
-  
-  // Only this branch uses userData
-  return processUserData(userData)
-}
-```
-
-**Correct: only blocks when needed**
-
-```typescript
-async function handleRequest(userId: string, skipProcessing: boolean) {
-  if (skipProcessing) {
-    // Returns immediately without waiting
-    return { skipped: true }
-  }
-  
-  // Fetch only when needed
-  const userData = await fetchUserData(userId)
-  return processUserData(userData)
-}
-```
-
-**Another example: early return optimization**
-
-```typescript
-// Incorrect: always fetches permissions
-async function updateResource(resourceId: string, userId: string) {
-  const permissions = await fetchPermissions(userId)
-  const resource = await getResource(resourceId)
-  
-  if (!resource) {
-    return { error: 'Not found' }
-  }
-  
-  if (!permissions.canEdit) {
-    return { error: 'Forbidden' }
-  }
-  
-  return await updateResourceData(resource, permissions)
-}
-
-// Correct: fetches only when needed
-async function updateResource(resourceId: string, userId: string) {
-  const resource = await getResource(resourceId)
-  
-  if (!resource) {
-    return { error: 'Not found' }
-  }
-  
-  const permissions = await fetchPermissions(userId)
-  
-  if (!permissions.canEdit) {
-    return { error: 'Forbidden' }
-  }
-  
-  return await updateResourceData(resource, permissions)
-}
-```
-
-This optimization is especially valuable when the skipped branch is frequently taken, or when the deferred operation is expensive.
-
-### 1.2 Dependency-Based Parallelization
-
-**Impact: CRITICAL (2-10× improvement)**
-
-For operations with partial dependencies, use `better-all` to maximize parallelism. It automatically starts each task at the earliest possible moment.
-
-**Incorrect: profile waits for config unnecessarily**
-
-```typescript
-const [user, config] = await Promise.all([
-  fetchUser(),
-  fetchConfig()
-])
-const profile = await fetchProfile(user.id)
-```
-
-**Correct: config and profile run in parallel**
-
-```typescript
-import { all } from 'better-all'
-
-const { user, config, profile } = await all({
-  async user() { return fetchUser() },
-  async config() { return fetchConfig() },
-  async profile() {
-    return fetchProfile((await this.$.user).id)
-  }
-})
-```
-
-Reference: [https://github.com/shuding/better-all](https://github.com/shuding/better-all)
-
-### 1.3 Prevent Waterfall Chains in API Routes
-
-**Impact: CRITICAL (2-10× improvement)**
-
-In API routes and Server Actions, start independent operations immediately, even if you don't await them yet.
-
-**Incorrect: config waits for auth, data waits for both**
-
-```typescript
-export async function GET(request: Request) {
-  const session = await auth()
-  const config = await fetchConfig()
-  const data = await fetchData(session.user.id)
-  return Response.json({ data, config })
-}
-```
-
-**Correct: auth and config start immediately**
-
-```typescript
-export async function GET(request: Request) {
-  const sessionPromise = auth()
-  const configPromise = fetchConfig()
-  const session = await sessionPromise
-  const [config, data] = await Promise.all([
-    configPromise,
-    fetchData(session.user.id)
-  ])
-  return Response.json({ data, config })
-}
-```
-
-For operations with more complex dependency chains, use `better-all` to automatically maximize parallelism (see Dependency-Based Parallelization).
-
-### 1.4 Promise.all() for Independent Operations
-
-**Impact: CRITICAL (2-10× improvement)**
-
-When async operations have no interdependencies, execute them concurrently using `Promise.all()`.
-
-**Incorrect: sequential execution, 3 round trips**
-
-```typescript
-const user = await fetchUser()
-const posts = await fetchPosts()
-const comments = await fetchComments()
-```
-
-**Correct: parallel execution, 1 round trip**
-
-```typescript
-const [user, posts, comments] = await Promise.all([
-  fetchUser(),
-  fetchPosts(),
-  fetchComments()
-])
-```
-
-### 1.5 Strategic Suspense Boundaries
-
-**Impact: HIGH (faster initial paint)**
-
-Instead of awaiting data in async components before returning JSX, use Suspense boundaries to show the wrapper UI faster while data loads.
-
-**Incorrect: wrapper blocked by data fetching**
-
-```tsx
-async function Page() {
-  const data = await fetchData() // Blocks entire page
-  
-  return (
-    <div>
-      <div>Sidebar</div>
-      <div>Header</div>
-      <div>
-        <DataDisplay data={data} />
-      </div>
-      <div>Footer</div>
-    </div>
-  )
-}
-```
-
-The entire layout waits for data even though only the middle section needs it.
-
-**Correct: wrapper shows immediately, data streams in**
-
-```tsx
-function Page() {
-  return (
-    <div>
-      <div>Sidebar</div>
-      <div>Header</div>
-      <div>
-        <Suspense fallback={<Skeleton />}>
-          <DataDisplay />
-        </Suspense>
-      </div>
-      <div>Footer</div>
-    </div>
-  )
-}
-
-async function DataDisplay() {
-  const data = await fetchData() // Only blocks this component
-  return <div>{data.content}</div>
-}
-```
-
-Sidebar, Header, and Footer render immediately. Only DataDisplay waits for data.
-
-**Alternative: share promise across components**
-
-```tsx
-function Page() {
-  // Start fetch immediately, but don't await
-  const dataPromise = fetchData()
-  
-  return (
-    <div>
-      <div>Sidebar</div>
-      <div>Header</div>
-      <Suspense fallback={<Skeleton />}>
-        <DataDisplay dataPromise={dataPromise} />
-        <DataSummary dataPromise={dataPromise} />
-      </Suspense>
-      <div>Footer</div>
-    </div>
-  )
-}
-
-function DataDisplay({ dataPromise }: { dataPromise: Promise<Data> }) {
-  const data = use(dataPromise) // Unwraps the promise
-  return <div>{data.content}</div>
-}
-
-function DataSummary({ dataPromise }: { dataPromise: Promise<Data> }) {
-  const data = use(dataPromise) // Reuses the same promise
-  return <div>{data.summary}</div>
-}
-```
-
-Both components share the same promise, so only one fetch occurs. Layout renders immediately while both components wait together.
-
-**When NOT to use this pattern:**
-
-- Critical data needed for layout decisions (affects positioning)
-
-- SEO-critical content above the fold
-
-- Small, fast queries where suspense overhead isn't worth it
-
-- When you want to avoid layout shift (loading → content jump)
-
-**Trade-off:** Faster initial paint vs potential layout shift. Choose based on your UX priorities.
-
----
-
-## 2. Bundle Size Optimization
-
-**Impact: CRITICAL**
-
-Reducing initial bundle size improves Time to Interactive and Largest Contentful Paint.
-
-### 2.1 Conditional Module Loading
-
-**Impact: HIGH (loads large data only when needed)**
-
-Load large data or modules only when a feature is activated.
-
-**Example: lazy-load animation frames**
-
-```tsx
-function AnimationPlayer({ enabled }: { enabled: boolean }) {
-  const [frames, setFrames] = useState<Frame[] | null>(null)
-
-  useEffect(() => {
-    if (enabled && !frames && typeof window !== 'undefined') {
-      import('./animation-frames.js')
-        .then(mod => setFrames(mod.frames))
-        .catch(() => setEnabled(false))
-    }
-  }, [enabled, frames])
-
-  if (!frames) return <Skeleton />
-  return <Canvas frames={frames} />
-}
-```
-
-The `typeof window !== 'undefined'` check prevents bundling this module for SSR, optimizing server bundle size and build speed.
-
-### 2.2 Defer Non-Critical Third-Party Libraries
-
-**Impact: MEDIUM (loads after hydration)**
-
-Analytics, logging, and error tracking don't block user interaction. Load them after hydration.
-
-**Incorrect: blocks initial bundle**
-
-```tsx
-import { Analytics } from '@vercel/analytics/react'
-
-export default function RootLayout({ children }) {
-  return (
-    <html>
-      <body>
-        {children}
-        <Analytics />
-      </body>
-    </html>
-  )
-}
-```
-
-**Correct: loads after hydration**
-
-```tsx
-import dynamic from 'next/dynamic'
-
-const Analytics = dynamic(
-  () => import('@vercel/analytics/react').then(m => m.Analytics),
-  { ssr: false }
-)
-
-export default function RootLayout({ children }) {
-  return (
-    <html>
-      <body>
-        {children}
-        <Analytics />
-      </body>
-    </html>
-  )
-}
-```
-
-### 2.3 Dynamic Imports for Heavy Components
-
-**Impact: CRITICAL (directly affects TTI and LCP)**
-
-Use `next/dynamic` to lazy-load large components not needed on initial render.
-
-**Incorrect: Monaco bundles with main chunk ~300KB**
-
-```tsx
-import { MonacoEditor } from './monaco-editor'
-
-function CodePanel({ code }: { code: string }) {
-  return <MonacoEditor value={code} />
-}
-```
-
-**Correct: Monaco loads on demand**
-
-```tsx
-import dynamic from 'next/dynamic'
-
-const MonacoEditor = dynamic(
-  () => import('./monaco-editor').then(m => m.MonacoEditor),
-  { ssr: false }
-)
-
-function CodePanel({ code }: { code: string }) {
-  return <MonacoEditor value={code} />
-}
-```
-
-### 2.4 Preload Based on User Intent
-
-**Impact: MEDIUM (reduces perceived latency)**
-
-Preload heavy bundles before they're needed to reduce perceived latency.
-
-**Example: preload on hover/focus**
-
-```tsx
-function EditorButton({ onClick }: { onClick: () => void }) {
-  const preload = () => {
-    if (typeof window !== 'undefined') {
-      void import('./monaco-editor')
-    }
-  }
-
-  return (
-    <button
-      onMouseEnter={preload}
-      onFocus={preload}
-      onClick={onClick}
-    >
-      Open Editor
-    </button>
-  )
-}
-```
-
-**Example: preload when feature flag is enabled**
-
-```tsx
-function FlagsProvider({ children, flags }: Props) {
-  useEffect(() => {
-    if (flags.editorEnabled && typeof window !== 'undefined') {
-      void import('./monaco-editor').then(mod => mod.init())
-    }
-  }, [flags.editorEnabled])
-
-  return <FlagsContext.Provider value={flags}>
-    {children}
-  </FlagsContext.Provider>
-}
-```
-
-The `typeof window !== 'undefined'` check prevents bundling preloaded modules for SSR, optimizing server bundle size and build speed.
-
----
-
-## 3. Server-Side Performance
-
-**Impact: HIGH**
-
-Optimizing server-side rendering for RSC context. Use non-blocking operations for logging and side effects.
-
-### 3.1 Use after() for Non-Blocking Operations
-
-**Impact: MEDIUM (faster response times)**
-
-Use Next.js's `after()` to schedule work that should execute after a response is sent. This prevents logging, analytics, and other side effects from blocking the response.
-
-**Incorrect: blocks response**
-
-```tsx
-import { logUserAction } from '@/app/utils'
-
-export async function POST(request: Request) {
-  // Perform mutation
-  await updateDatabase(request)
-  
-  // Logging blocks the response
-  const userAgent = request.headers.get('user-agent') || 'unknown'
-  await logUserAction({ userAgent })
-  
-  return new Response(JSON.stringify({ status: 'success' }), {
-    status: 200,
-    headers: { 'Content-Type': 'application/json' }
-  })
-}
-```
-
-**Correct: non-blocking**
-
-```tsx
-import { after } from 'next/server'
-import { headers, cookies } from 'next/headers'
-import { logUserAction } from '@/app/utils'
-
-export async function POST(request: Request) {
-  // Perform mutation
-  await updateDatabase(request)
-  
-  // Log after response is sent
-  after(async () => {
-    const userAgent = (await headers()).get('user-agent') || 'unknown'
-    const sessionCookie = (await cookies()).get('session-id')?.value || 'anonymous'
-    
-    logUserAction({ sessionCookie, userAgent })
-  })
-  
-  return new Response(JSON.stringify({ status: 'success' }), {
-    status: 200,
-    headers: { 'Content-Type': 'application/json' }
-  })
-}
-```
-
-The response is sent immediately while logging happens in the background.
-
-**Common use cases:**
-
-- Analytics tracking
-
-- Audit logging
-
-- Sending notifications
-
-- Cache invalidation
-
-- Cleanup tasks
-
-**Important notes:**
-
-- `after()` runs even if the response fails or redirects
-
-- Works in Server Actions, Route Handlers, and Server Components
-
-Reference: [https://nextjs.org/docs/app/api-reference/functions/after](https://nextjs.org/docs/app/api-reference/functions/after)
-
----
-
-## 4. Client-Side Data Fetching
-
-**Impact: MEDIUM-HIGH**
-
-Use Orval-generated hooks with @tanstack/query for consistent API data fetching. Avoid RSC async data fetching which creates duplicate logic layers.
-
-### 4.1 Use React Compiler Optimal
-
-**Impact: MEDIUM (avoids redundant memoization)**
-
-React Compiler (enabled in this project) automatically handles memoization for `useMemo`, `useCallback`, `React.memo`. **Use these hooks only when profiling a bottleneck.**
-
-#### When to Use Manual Memoization
-
-Even with React Compiler enabled, there are **rare cases** where manual memoization might help:
-
-##### 1. Expensive Computations NOT in Render Path
-
-```tsx
-// ✅ Correct: Memoize expensive computation
-function ExpensiveChart({ data }: { data: DataPoint[] }) {
-  const processedData = useMemo(() => {
-    return data.map(point => ({
-      x: point.x * 1000, // Expensive transform
-      y: Math.log(point.y) // Expensive calculation
-    }))
-  }, [data])
-
-  return <Chart data={processedData} />
-}
-```
-
-```tsx
-// ❌ Incorrect: Memoize cheap props (redundant with React Compiler)
-function SimpleChart({ data }: { data: DataPoint[] }) {
-  const processedData = useMemo(() => {
-    return data.map(point => point) // Too simple, not worth memoizing
-  }, [data])
-
-  return <Chart data={processedData} />
-}
-```
-
-##### 2. Memoizing Values Used Across Renders
-
-```tsx
-// ✅ Correct: Memoize value reused in multiple renders
-function Dashboard() {
-  const { data } = useHeavyData() // Expensive computation
-
-  return (
-    <>
-      <Card title="Summary">
-        <SummaryWidget value={data} />
-      </Card>
-      <Card title="Details">
-        <DetailsWidget value={data} />
-      </Card>
-    </>
-  )
-}
-```
-
-##### 3. Referential Stability for Custom Hooks
-
-```tsx
-// ✅ Correct: Use useMemo for derived state
-function useDerivedState(base: number) {
-  const doubled = useMemo(() => base * 2, [base])
-  const squared = useMemo(() => base * base, [base])
-
-  return { doubled, squared }
-}
-```
-
-### 4.2 Use Orval-Generated Hooks for API Data Fetching
-
-**Impact: HIGH (type-safe, deduplicated, cached)**
-
-Always use Orval-generated React Query hooks for API data fetching in Client Components. These hooks provide type safety, automatic deduplication, and caching.
-
-**Incorrect: Manual fetch in component**
-
-```tsx
-function UserProfile({ userId }: { userId: string }) {
-  const [user, setUser] = useState<User | null>(null)
-  const [loading, setLoading] = useState(true)
-
-  useEffect(() => {
-    fetch(`/api/users/${userId}`)
-      .then(res => res.json())
-      .then(setUser)
-      .finally(() => setLoading(false))
-  }, [userId])
-
-  if (loading) return <Skeleton />
-  return <div>{user?.name}</div>
-}
-```
-
-**Correct: Orval-generated hook**
-
-```tsx
-import { useGetUser } from '@/lib/api/users'
-
-function UserProfile({ userId }: { userId: string }) {
-  const { data: user, isLoading } = useGetUser(userId)
-
-  if (isLoading) return <Skeleton />
-  return <div>{user?.name}</div>
-}
-```
-
-### 4.3 Use @tanstack/query for Automatic Deduplication
-
-**Impact: MEDIUM-HIGH (eliminates duplicate requests)**
-
-React Query automatically deduplicates requests with the same key. Multiple components can use the same query without triggering multiple network requests.
-
-**Example: shared query across components**
-
-```tsx
-function Header() {
-  const { data: user } = useGetCurrentUser()
-  return <nav>{user?.name}</nav>
-}
-
-function Sidebar() {
-  const { data: user } = useGetCurrentUser()
-  return <aside>{user?.role}</aside>
-}
-
-function Dashboard() {
-  return (
-    <>
-      <Header />
-      <Sidebar />
-      {/* Only ONE network request is made */}
-    </>
-  )
-}
-```
-
-### 4.4 Deduplicate Global Event Listeners
-
-**Impact: MEDIUM (prevents memory leaks and redundant handlers)**
-
-Use `ahooks` hooks for global events to prevent multiple subscriptions and ensure proper cleanup.
-
-**Incorrect: each component creates its own listener**
-
-```tsx
-function Component1() {
-  useEffect(() => {
-    const handler = () => console.log('resize')
-    window.addEventListener('resize', handler)
-    return () => window.removeEventListener('resize', handler)
-  }, [])
-}
-
-function Component2() {
-  useEffect(() => {
-    const handler = () => console.log('resize')
-    window.addEventListener('resize', handler)
-    return () => window.removeEventListener('resize', handler)
-  }, [])
-}
-```
-
-**Correct: use ahooks hooks**
-
-```tsx
-import { useEventListener } from 'ahooks'
-
-// Option 1: Listen to resize event directly
-function Component1() {
-  useEventListener('resize', () => console.log('resize'))
-}
-
-// Option 2: Get window dimensions reactively with useEventListener
-function Component2() {
-  const [size, setSize] = useState({ width: 0, height: 0 })
-  useEventListener('resize', () => {
-    setSize({ width: window.innerWidth, height: window.innerHeight })
-  })
-  // Automatically updates on resize
-}
-```
-
-`useEventListener` handles cleanup automatically and stores the handler in a ref internally, preventing unnecessary re-subscriptions.
-
----
-
-## 5. Re-render Optimization
-
-**Impact: MEDIUM**
-
-Reducing unnecessary re-renders minimizes wasted computation and improves UI responsiveness.
-
-### 5.1 Defer State Reads to Usage Point
-
-**Impact: MEDIUM (reduces unnecessary re-renders)**
-
-Don't subscribe components to state they only use in callbacks. Access the state at the point of use instead.
-
-**Incorrect: component re-renders on every count change**
-
-```tsx
-function Counter() {
-  const [count, setCount] = useState(0)
-  
-  const handleClick = () => {
-    console.log(`Current count: ${count}`)
-    setCount(count + 1)
-  }
-  
-  return <button onClick={handleClick}>Increment</button>
-}
-```
-
-**Correct: use functional update**
-
-```tsx
-function Counter() {
-  const [, setCount] = useState(0)
-  
-  const handleClick = () => {
-    setCount(prev => {
-      console.log(`Current count: ${prev}`)
-      return prev + 1
-    })
-  }
-  
-  return <button onClick={handleClick}>Increment</button>
-}
-```
-
-### 5.2 Extract to Memoized Components
-
-**Impact: MEDIUM (isolates re-renders)**
-
-Extract expensive parts into separate components to isolate re-renders.
-
-**Incorrect: entire component re-renders**
-
-```tsx
-function Dashboard({ data }: { data: Data }) {
-  const [filter, setFilter] = useState('')
-  
-  return (
-    <div>
-      <input value={filter} onChange={e => setFilter(e.target.value)} />
-      <ExpensiveChart data={data} />
-      <ExpensiveTable data={data} />
-    </div>
-  )
-}
-```
-
-**Correct: expensive parts isolated**
-
-```tsx
-function Dashboard({ data }: { data: Data }) {
-  const [filter, setFilter] = useState('')
-  
-  return (
-    <div>
-      <input value={filter} onChange={e => setFilter(e.target.value)} />
-      <MemoizedChart data={data} />
-      <MemoizedTable data={data} />
-    </div>
-  )
-}
-
-const MemoizedChart = memo(ExpensiveChart)
-const MemoizedTable = memo(ExpensiveTable)
-```
-
-### 5.3 Narrow Effect Dependencies
-
-**Impact: MEDIUM (reduces effect re-runs)**
-
-Use primitive values in effect dependencies instead of objects.
-
-**Incorrect: effect runs on every render**
-
-```tsx
-function Profile({ user }: { user: User }) {
-  useEffect(() => {
-    trackPageView(user.id)
-  }, [user]) // Runs whenever user object changes
-}
-```
-
-**Correct: effect runs only when id changes**
-
-```tsx
-function Profile({ user }: { user: User }) {
-  const userId = user.id
-  
-  useEffect(() => {
-    trackPageView(userId)
-  }, [userId]) // Runs only when id changes
-}
-```
-
-### 5.4 Subscribe to Derived State
-
-**Impact: MEDIUM (reduces re-render frequency)**
-
-Subscribe to derived boolean state instead of continuous values to reduce re-render frequency. Use `useResponsive` from `ahooks`.
-
-**Incorrect: re-renders on every pixel change**
-
-```tsx
-function Sidebar() {
-  const width = useWindowWidth()  // updates continuously
-  const isMobile = width < 768
-  return <nav className={isMobile ? 'mobile' : 'desktop'}>
-}
-```
-
-**Correct: re-renders only when breakpoint changes**
-
-```tsx
-import { useResponsive } from 'ahooks'
-
-function Sidebar() {
-  const responsive = useResponsive()
-  const isMobile = !responsive.md  // md breakpoint is 768px by default
-  return <nav className={isMobile ? 'mobile' : 'desktop'}>
-}
-```
-
-`useResponsive` uses breakpoint-based updates and only triggers re-renders when the breakpoint state changes, not on every pixel.
-
-### 5.5 Use Functional setState Updates
-
-**Impact: MEDIUM (prevents stale closures and unnecessary callback recreations)**
-
-When updating state based on the current state value, use the functional update form of setState instead of directly referencing the state variable. This prevents stale closures, eliminates unnecessary dependencies, and creates stable callback references.
-
-**Incorrect: requires state as dependency**
-
-```tsx
-function TodoList() {
-  const [items, setItems] = useState(initialItems)
-  
-  // Callback must depend on items, recreated on every items change
-  const addItems = useCallback((newItems: Item[]) => {
-    setItems([...items, ...newItems])
-  }, [items])  // ❌ items dependency causes recreations
-  
-  // Risk of stale closure if dependency is forgotten
-  const removeItem = useCallback((id: string) => {
-    setItems(items.filter(item => item.id !== id))
-  }, [])  // ❌ Missing items dependency - will use stale items!
-  
-  return <ItemsEditor items={items} onAdd={addItems} onRemove={removeItem} />
-}
-```
-
-The first callback is recreated every time `items` changes, which can cause child components to re-render unnecessarily. The second callback has a stale closure bug—it will always reference the initial `items` value.
-
-**Correct: stable callbacks, no stale closures**
-
-```tsx
-function TodoList() {
-  const [items, setItems] = useState(initialItems)
-  
-  // Stable callback, never recreated
-  const addItems = useCallback((newItems: Item[]) => {
-    setItems(curr => [...curr, ...newItems])
-  }, [])  // ✅ No dependencies needed
-  
-  // Always uses latest state, no stale closure risk
-  const removeItem = useCallback((id: string) => {
-    setItems(curr => curr.filter(item => item.id !== id))
-  }, [])  // ✅ Safe and stable
-  
-  return <ItemsEditor items={items} onAdd={addItems} onRemove={removeItem} />
-}
-```
-
-**Benefits:**
-
-1. **Stable callback references** - Callbacks don't need to be recreated when state changes
-
-2. **No stale closures** - Always operates on the latest state value
-
-3. **Fewer dependencies** - Simplifies dependency arrays and reduces memory leaks
-
-4. **Prevents bugs** - Eliminates the most common source of React closure bugs
-
-**When to use functional updates:**
-
-- Any setState that depends on the current state value
-
-- Inside useCallback/useMemo when state is needed
-
-- Event handlers that reference state
-
-- Async operations that update state
-
-**When direct updates are fine:**
-
-- Setting state to a static value: `setCount(0)`
-
-- Setting state from props/arguments only: `setName(newName)`
-
-- State doesn't depend on previous value
-
-**Note:** If your project has [React Compiler](https://react.dev/learn/react-compiler) enabled, the compiler can automatically optimize some cases, but functional updates are still recommended for correctness and to prevent stale closure bugs.
-
-### 5.6 Use Lazy State Initialization
-
-**Impact: MEDIUM (wasted computation on every render)**
-
-Pass a function to `useState` for expensive initial values. Without the function form, the initializer runs on every render even though the value is only used once.
-
-**Incorrect: runs on every render**
-
-```tsx
-function FilteredList({ items }: { items: Item[] }) {
-  // buildSearchIndex() runs on EVERY render, even after initialization
-  const [searchIndex, setSearchIndex] = useState(buildSearchIndex(items))
-  const [query, setQuery] = useState('')
-  
-  // When query changes, buildSearchIndex runs again unnecessarily
-  return <SearchResults index={searchIndex} query={query} />
-}
-
-function UserProfile() {
-  // JSON.parse runs on every render
-  const [settings, setSettings] = useState(
-    JSON.parse(localStorage.getItem('settings') || '{}')
-  )
-  
-  return <SettingsForm settings={settings} onChange={setSettings} />
-}
-```
-
-**Correct: runs only once**
-
-```tsx
-function FilteredList({ items }: { items: Item[] }) {
-  // buildSearchIndex() runs ONLY on initial render
-  const [searchIndex, setSearchIndex] = useState(() => buildSearchIndex(items))
-  const [query, setQuery] = useState('')
-  
-  return <SearchResults index={searchIndex} query={query} />
-}
-
-function UserProfile() {
-  // JSON.parse runs only on initial render
-  const [settings, setSettings] = useState(() => {
-    const stored = localStorage.getItem('settings')
-    return stored ? JSON.parse(stored) : {}
-  })
-  
-  return <SettingsForm settings={settings} onChange={setSettings} />
-}
-```
-
-Use lazy initialization when computing initial values from localStorage/sessionStorage, building data structures (indexes, maps), reading from the DOM, or performing heavy transformations.
-
-For simple primitives (`useState(0)`), direct references (`useState(props.value)`), or cheap literals (`useState({})`), the function form is unnecessary.
-
-### 5.7 Use Transitions for Non-Urgent Updates
-
-**Impact: MEDIUM (maintains UI responsiveness)**
-
-Mark frequent, non-urgent state updates as transitions to maintain UI responsiveness. Alternatively, use throttling from `ahooks`.
-
-**Incorrect: blocks UI on every scroll**
-
-```tsx
-function ScrollTracker() {
-  const [scrollY, setScrollY] = useState(0)
-  useEffect(() => {
-    const handler = () => setScrollY(window.scrollY)
-    window.addEventListener('scroll', handler, { passive: true })
-    return () => window.removeEventListener('scroll', handler)
-  }, [])
-}
-```
-
-**Correct: non-blocking updates with startTransition**
-
-```tsx
-import { startTransition } from 'react'
-
-function ScrollTracker() {
-  const [scrollY, setScrollY] = useState(0)
-  useEffect(() => {
-    const handler = () => {
-      startTransition(() => setScrollY(window.scrollY))
-    }
-    window.addEventListener('scroll', handler, { passive: true })
-    return () => window.removeEventListener('scroll', handler)
-  }, [])
-}
-```
-
-**Alternative: throttling with ahooks**
-
-```tsx
-import { useEventListener, useThrottle } from 'ahooks'
-
-function ScrollTracker() {
-  const [scrollY, setScrollY] = useState(0)
-  const throttledScrollY = useThrottle(scrollY, { wait: 100 }) // Update max 10x/sec
-
-  useEventListener('scroll', () => setScrollY(window.scrollY))
-
-  // Use throttledScrollY for rendering
-  return <div>Scroll: {throttledScrollY}px</div>
-}
-```
-
-Throttling is often more appropriate for scroll events as it provides consistent update intervals.
-
----
-
-## 6. Rendering Performance
-
-**Impact: MEDIUM**
-
-Optimizing the rendering process reduces the work the browser needs to do.
-
-### 6.1 Animate SVG Wrapper Instead of SVG Element
-
-**Impact: LOW (enables hardware acceleration)**
-
-Many browsers don't have hardware acceleration for CSS3 animations on SVG elements. Wrap SVG in a `<div>` and animate the wrapper instead.
-
-**Incorrect: animating SVG directly - no hardware acceleration**
-
-```tsx
-function LoadingSpinner() {
-  return (
-    <svg 
-      className="animate-spin"
-      width="24" 
-      height="24" 
-      viewBox="0 0 24 24"
-    >
-      <circle cx="12" cy="12" r="10" stroke="currentColor" />
-    </svg>
-  )
-}
-```
-
-**Correct: animating wrapper div - hardware accelerated**
-
-```tsx
-function LoadingSpinner() {
-  return (
-    <div className="animate-spin">
-      <svg 
-        width="24" 
-        height="24" 
-        viewBox="0 0 24 24"
-      >
-        <circle cx="12" cy="12" r="10" stroke="currentColor" />
-      </svg>
-    </div>
-  )
-}
-```
-
-This applies to all CSS transforms and transitions (`transform`, `opacity`, `translate`, `scale`, `rotate`). The wrapper div allows browsers to use GPU acceleration for smoother animations.
-
-### 6.2 CSS content-visibility for Long Lists
-
-**Impact: HIGH (faster initial render)**
-
-Apply `content-visibility: auto` to defer off-screen rendering.
-
-**CSS:**
-
-```css
-.message-item {
-  content-visibility: auto;
-  contain-intrinsic-size: 0 80px;
-}
-```
-
-**Example:**
-
-```tsx
-function MessageList({ messages }: { messages: Message[] }) {
-  return (
-    <div className="overflow-y-auto h-screen">
-      {messages.map(msg => (
-        <div key={msg.id} className="message-item">
-          <Avatar user={msg.author} />
-          <div>{msg.content}</div>
-        </div>
-      ))}
-    </div>
-  )
-}
-```
-
-For 1000 messages, browser skips layout/paint for ~990 off-screen items (10× faster initial render).
-
-### 6.3 Hoist Static JSX Elements
-
-**Impact: LOW (avoids re-creation)**
-
-Extract static JSX outside components to avoid re-creation.
-
-**Incorrect: recreates element every render**
-
-```tsx
-function LoadingSkeleton() {
-  return <div className="animate-pulse h-20 bg-gray-200" />
-}
-
-function Container() {
-  return (
-    <div>
-      {loading && <LoadingSkeleton />}
-    </div>
-  )
-}
-```
-
-**Correct: reuses same element**
-
-```tsx
-const loadingSkeleton = (
-  <div className="animate-pulse h-20 bg-gray-200" />
-)
-
-function Container() {
-  return (
-    <div>
-      {loading && loadingSkeleton}
-    </div>
-  )
-}
-```
-
-This is especially helpful for large and static SVG nodes, which can be expensive to recreate on every render.
-
-**Note:** If your project has [React Compiler](https://react.dev/learn/react-compiler) enabled, the compiler automatically hoists static JSX elements and optimizes component re-renders, making manual hoisting unnecessary.
-
-### 6.4 Optimize SVG Precision
-
-**Impact: LOW (reduces file size)**
-
-Reduce SVG coordinate precision to decrease file size. The optimal precision depends on the viewBox size, but in general reducing precision should be considered.
-
-**Incorrect: excessive precision**
-
-```svg
-<path d="M 10.293847 20.847362 L 30.938472 40.192837" />
-```
-
-**Correct: 1 decimal place**
-
-```svg
-<path d="M 10.3 20.8 L 30.9 40.2" />
-```
-
-**Automate with SVGO:**
-
-```bash
-npx svgo --precision=1 --multipass icon.svg
-```
-
-### 6.5 Prevent Hydration Mismatch Without Flickering
-
-**Impact: MEDIUM (avoids visual flicker and hydration errors)**
-
-When rendering content that depends on client-side storage (localStorage, cookies), avoid both SSR breakage and post-hydration flickering by injecting a synchronous script that updates the DOM before React hydrates.
-
-**Incorrect: breaks SSR**
-
-```tsx
-function ThemeWrapper({ children }: { children: ReactNode }) {
-  // localStorage is not available on server - throws error
-  const theme = localStorage.getItem('theme') || 'light'
-  
-  return (
-    <div className={theme}>
-      {children}
-    </div>
-  )
-}
-```
-
-Server-side rendering will fail because `localStorage` is undefined.
-
-**Incorrect: visual flickering**
-
-```tsx
-function ThemeWrapper({ children }: { children: ReactNode }) {
-  const [theme, setTheme] = useState('light')
-  
-  useEffect(() => {
-    // Runs after hydration - causes visible flash
-    const stored = localStorage.getItem('theme')
-    if (stored) {
-      setTheme(stored)
-    }
-  }, [])
-  
-  return (
-    <div className={theme}>
-      {children}
-    </div>
-  )
-}
-```
-
-Component first renders with default value (`light`), then updates after hydration, causing a visible flash of incorrect content.
-
-**Correct: no flicker, no hydration mismatch**
-
-```tsx
-function ThemeWrapper({ children }: { children: ReactNode }) {
-  return (
-    <>
-      <div id="theme-wrapper">
-        {children}
-      </div>
-      <script
-        dangerouslySetInnerHTML={{
-          __html: `
-            (function() {
-              try {
-                var theme = localStorage.getItem('theme') || 'light';
-                var el = document.getElementById('theme-wrapper');
-                if (el) el.className = theme;
-              } catch (e) {}
-            })();
-          `,
-        }}
-      />
-    </>
-  )
-}
-```
-
-The inline script executes synchronously before showing the element, ensuring the DOM already has the correct value. No flickering, no hydration mismatch.
-
-This pattern is especially useful for theme toggles, user preferences, authentication states, and any client-only data that should render immediately without flashing default values.
-
-### 6.6 Use Activity Component for Show/Hide
-
-**Impact: MEDIUM (preserves state/DOM)**
-
-Use React's `<Activity>` to preserve state/DOM for expensive components that frequently toggle visibility.
-
-**Usage:**
-
-```tsx
-import { Activity } from 'react'
-
-function Dropdown({ isOpen }: Props) {
-  return (
-    <Activity mode={isOpen ? 'visible' : 'hidden'}>
-      <ExpensiveMenu />
-    </Activity>
-  )
-}
-```
-
-Avoids expensive re-renders and state loss.
-
----
-
-## 7. JavaScript Performance
-
-**Impact: LOW-MEDIUM**
-
-Micro-optimizations for hot paths can add up to meaningful improvements.
-
-### 7.1 Batch DOM CSS Changes
-
-**Impact: MEDIUM (reduces reflows/repaints)**
-
-Avoid changing styles one property at a time. Group multiple CSS changes together via classes or `cssText` to minimize browser reflows.
-
-**Incorrect: multiple reflows**
-
-```typescript
-function updateElementStyles(element: HTMLElement) {
-  // Each line triggers a reflow
-  element.style.width = '100px'
-  element.style.height = '200px'
-  element.style.backgroundColor = 'blue'
-  element.style.border = '1px solid black'
-}
-```
-
-**Correct: add class - single reflow**
-
-```typescript
-// CSS file
-.highlighted-box {
-  width: 100px;
-  height: 200px;
-  background-color: blue;
-  border: 1px solid black;
-}
-
-// JavaScript
-function updateElementStyles(element: HTMLElement) {
-  element.classList.add('highlighted-box')
-}
-```
-
-**Correct: change cssText - single reflow**
-
-```typescript
-function updateElementStyles(element: HTMLElement) {
-  element.style.cssText = `
-    width: 100px;
-    height: 200px;
-    background-color: blue;
-    border: 1px solid black;
-  `
-}
-```
-
-**React example:**
-
-```tsx
-// Incorrect: changing styles one by one
-function Box({ isHighlighted }: { isHighlighted: boolean }) {
-  const ref = useRef<HTMLDivElement>(null)
-  
-  useEffect(() => {
-    if (ref.current && isHighlighted) {
-      ref.current.style.width = '100px'
-      ref.current.style.height = '200px'
-      ref.current.style.backgroundColor = 'blue'
-    }
-  }, [isHighlighted])
-  
-  return <div ref={ref}>Content</div>
-}
-
-// Correct: toggle class
-function Box({ isHighlighted }: { isHighlighted: boolean }) {
-  return (
-    <div className={isHighlighted ? 'highlighted-box' : ''}>
-      Content
-    </div>
-  )
-}
-```
-
-Prefer CSS classes over inline styles when possible. Classes are cached by the browser and provide better separation of concerns.
-
-### 7.2 Build Index Maps for Repeated Lookups
-
-**Impact: LOW-MEDIUM (1M ops to 2K ops)**
-
-Multiple `.find()` calls by the same key should use a Map.
-
-**Incorrect (O(n) per lookup):**
-
-```typescript
-function processOrders(orders: Order[], users: User[]) {
-  return orders.map(order => ({
-    ...order,
-    user: users.find(u => u.id === order.userId)
-  }))
-}
-```
-
-**Correct (O(1) per lookup):**
-
-```typescript
-function processOrders(orders: Order[], users: User[]) {
-  const userById = new Map(users.map(u => [u.id, u]))
-
-  return orders.map(order => ({
-    ...order,
-    user: userById.get(order.userId)
-  }))
-}
-```
-
-Build map once (O(n)), then all lookups are O(1).
-
-For 1000 orders × 1000 users: 1M ops → 2K ops.
-
-### 7.3 Cache Property Access in Loops
-
-**Impact: LOW-MEDIUM (reduces lookups)**
-
-Cache object property lookups in hot paths.
-
-**Incorrect: 3 lookups × N iterations**
-
-```typescript
-for (let i = 0; i < arr.length; i++) {
-  process(obj.config.settings.value)
-}
-```
-
-**Correct: 1 lookup total**
-
-```typescript
-const value = obj.config.settings.value
-const len = arr.length
-for (let i = 0; i < len; i++) {
-  process(value)
-}
-```
-
-### 7.4 Cache Repeated Function Calls
-
-**Impact: MEDIUM (avoid redundant computation)**
-
-Use a module-level Map to cache function results when the same function is called repeatedly with the same inputs during render.
-
-**Incorrect: redundant computation**
-
-```typescript
-function ProjectList({ projects }: { projects: Project[] }) {
-  return (
-    <div>
-      {projects.map(project => {
-        // slugify() called 100+ times for same project names
-        const slug = slugify(project.name)
-        
-        return <ProjectCard key={project.id} slug={slug} />
-      })}
-    </div>
-  )
-}
-```
-
-**Correct: cached results**
-
-```typescript
-// Module-level cache
-const slugifyCache = new Map<string, string>()
-
-function cachedSlugify(text: string): string {
-  if (slugifyCache.has(text)) {
-    return slugifyCache.get(text)!
-  }
-  const result = slugify(text)
-  slugifyCache.set(text, result)
-  return result
-}
-
-function ProjectList({ projects }: { projects: Project[] }) {
-  return (
-    <div>
-      {projects.map(project => {
-        // Computed only once per unique project name
-        const slug = cachedSlugify(project.name)
-        
-        return <ProjectCard key={project.id} slug={slug} />
-      })}
-    </div>
-  )
-}
-```
-
-**Simpler pattern for single-value functions:**
-
-```typescript
-let isLoggedInCache: boolean | null = null
-
-function isLoggedIn(): boolean {
-  if (isLoggedInCache !== null) {
-    return isLoggedInCache
-  }
-  
-  isLoggedInCache = document.cookie.includes('auth=')
-  return isLoggedInCache
-}
-
-// Clear cache when auth changes
-function onAuthChange() {
-  isLoggedInCache = null
-}
-```
-
-Use a Map (not a hook) so it works everywhere: utilities, event handlers, not just React components.
-
-Reference: [https://vercel.com/blog/how-we-made-the-vercel-dashboard-twice-as-fast](https://vercel.com/blog/how-we-made-the-vercel-dashboard-twice-as-fast)
-
-### 7.5 Cache Storage API Calls
-
-**Impact: LOW-MEDIUM (reduces expensive I/O)**
-
-`localStorage`, `sessionStorage`, and `document.cookie` are synchronous and expensive. Cache reads in memory.
-
-**Incorrect: reads storage on every call**
-
-```typescript
-function getTheme() {
-  return localStorage.getItem('theme') ?? 'light'
-}
-// Called 10 times = 10 storage reads
-```
-
-**Correct: Map cache**
-
-```typescript
-const storageCache = new Map<string, string | null>()
-
-function getLocalStorage(key: string) {
-  if (!storageCache.has(key)) {
-    storageCache.set(key, localStorage.getItem(key))
-  }
-  return storageCache.get(key)
-}
-
-function setLocalStorage(key: string, value: string) {
-  localStorage.setItem(key, value)
-  storageCache.set(key, value)  // keep cache in sync
-}
-```
-
-Use a Map (not a hook) so it works everywhere: utilities, event handlers, not just React components.
-
-**Cookie caching:**
-
-```typescript
-let cookieCache: Record<string, string> | null = null
-
-function getCookie(name: string) {
-  if (!cookieCache) {
-    cookieCache = Object.fromEntries(
-      document.cookie.split('; ').map(c => c.split('='))
-    )
-  }
-  return cookieCache[name]
-}
-```
-
-**Important: invalidate on external changes**
-
-```typescript
-window.addEventListener('storage', (e) => {
-  if (e.key) storageCache.delete(e.key)
-})
-
-document.addEventListener('visibilitychange', () => {
-  if (document.visibilityState === 'visible') {
-    storageCache.clear()
-  }
-})
-```
-
-If storage can change externally (another tab, server-set cookies), invalidate cache:
-
-### 7.6 Combine Multiple Array Iterations
-
-**Impact: LOW-MEDIUM (reduces iterations)**
-
-Multiple `.filter()` or `.map()` calls iterate the array multiple times. Combine into one loop.
-
-**Incorrect: 3 iterations**
-
-```typescript
-const admins = users.filter(u => u.isAdmin)
-const testers = users.filter(u => u.isTester)
-const inactive = users.filter(u => !u.isActive)
-```
-
-**Correct: 1 iteration**
-
-```typescript
-const admins: User[] = []
-const testers: User[] = []
-const inactive: User[] = []
-
-for (const user of users) {
-  if (user.isAdmin) admins.push(user)
-  if (user.isTester) testers.push(user)
-  if (!user.isActive) inactive.push(user)
-}
-```
-
-### 7.7 Early Length Check for Array Comparisons
-
-**Impact: MEDIUM-HIGH (avoids expensive operations when lengths differ)**
-
-When comparing arrays with expensive operations (sorting, deep equality, serialization), check lengths first. If lengths differ, the arrays cannot be equal.
-
-In real-world applications, this optimization is especially valuable when the comparison runs in hot paths (event handlers, render loops).
-
-**Incorrect: always runs expensive comparison**
-
-```typescript
-function hasChanges(current: string[], original: string[]) {
-  // Always sorts and joins, even when lengths differ
-  return current.sort().join() !== original.sort().join()
-}
-```
-
-Two O(n log n) sorts run even when `current.length` is 5 and `original.length` is 100. There is also overhead of joining the arrays and comparing the strings.
-
-**Correct (O(1) length check first):**
-
-```typescript
-function hasChanges(current: string[], original: string[]) {
-  // Early return if lengths differ
-  if (current.length !== original.length) {
-    return true
-  }
-  // Only sort/join when lengths match
-  const currentSorted = current.toSorted()
-  const originalSorted = original.toSorted()
-  for (let i = 0; i < currentSorted.length; i++) {
-    if (currentSorted[i] !== originalSorted[i]) {
-      return true
-    }
-  }
-  return false
-}
-```
-
-This new approach is more efficient because:
-
-- It avoids the overhead of sorting and joining the arrays when lengths differ
-
-- It avoids consuming memory for the joined strings (especially important for large arrays)
-
-- It avoids mutating the original arrays
-
-- It returns early when a difference is found
-
-### 7.8 Early Return from Functions
-
-**Impact: LOW-MEDIUM (avoids unnecessary computation)**
-
-Return early when result is determined to skip unnecessary processing.
-
-**Incorrect: processes all items even after finding answer**
-
-```typescript
-function validateUsers(users: User[]) {
-  let hasError = false
-  let errorMessage = ''
-  
-  for (const user of users) {
-    if (!user.email) {
-      hasError = true
-      errorMessage = 'Email required'
-    }
-    if (!user.name) {
-      hasError = true
-      errorMessage = 'Name required'
-    }
-    // Continues checking all users even after error found
-  }
-  
-  return hasError ? { valid: false, error: errorMessage } : { valid: true }
-}
-```
-
-**Correct: returns immediately on first error**
-
-```typescript
-function validateUsers(users: User[]) {
-  for (const user of users) {
-    if (!user.email) {
-      return { valid: false, error: 'Email required' }
-    }
-    if (!user.name) {
-      return { valid: false, error: 'Name required' }
-    }
-  }
-
-  return { valid: true }
-}
-```
-
-### 7.9 Use Loop for Min/Max Instead of Sort
-
-**Impact: LOW (O(n) instead of O(n log n))**
-
-Finding the smallest or largest element only requires a single pass through the array. Sorting is wasteful and slower.
-
-**Incorrect (O(n log n) - sort to find latest):**
-
-```typescript
-interface Project {
-  id: string
-  name: string
-  updatedAt: number
-}
-
-function getLatestProject(projects: Project[]) {
-  const sorted = [...projects].sort((a, b) => b.updatedAt - a.updatedAt)
-  return sorted[0]
-}
-```
-
-Sorts the entire array just to find the maximum value.
-
-**Incorrect (O(n log n) - sort for oldest and newest):**
-
-```typescript
-function getOldestAndNewest(projects: Project[]) {
-  const sorted = [...projects].sort((a, b) => a.updatedAt - b.updatedAt)
-  return { oldest: sorted[0], newest: sorted[sorted.length - 1] }
-}
-```
-
-Still sorts unnecessarily when only min/max are needed.
-
-**Correct (O(n) - single loop):**
-
-```typescript
-function getLatestProject(projects: Project[]) {
-  if (projects.length === 0) return null
-  
-  let latest = projects[0]
-  
-  for (let i = 1; i < projects.length; i++) {
-    if (projects[i].updatedAt > latest.updatedAt) {
-      latest = projects[i]
-    }
-  }
-  
-  return latest
-}
-
-function getOldestAndNewest(projects: Project[]) {
-  if (projects.length === 0) return { oldest: null, newest: null }
-  
-  let oldest = projects[0]
-  let newest = projects[0]
-  
-  for (let i = 1; i < projects.length; i++) {
-    if (projects[i].updatedAt < oldest.updatedAt) oldest = projects[i]
-    if (projects[i].updatedAt > newest.updatedAt) newest = projects[i]
-  }
-  
-  return { oldest, newest }
-}
-```
-
-Single pass through the array, no copying, no sorting.
-
-**Alternative: Math.min/Math.max for small arrays**
-
-```typescript
-const numbers = [5, 2, 8, 1, 9]
-const min = Math.min(...numbers)
-const max = Math.max(...numbers)
-```
-
-This works for small arrays but can be slower for very large arrays due to spread operator limitations. Use the loop approach for reliability.
-
-### 7.10 Use Set/Map for O(1) Lookups
-
-**Impact: LOW-MEDIUM (O(n) to O(1))**
-
-Convert arrays to Set/Map for repeated membership checks.
-
-**Incorrect (O(n) per check):**
-
-```typescript
-const allowedIds = ['a', 'b', 'c', ...]
-items.filter(item => allowedIds.includes(item.id))
-```
-
-**Correct (O(1) per check):**
-
-```typescript
-const allowedIds = new Set(['a', 'b', 'c', ...])
-items.filter(item => allowedIds.has(item.id))
-```
-
-### 7.11 Use toSorted() Instead of sort() for Immutability
-
-**Impact: MEDIUM-HIGH (prevents mutation bugs in React state)**
-
-`.sort()` mutates the array in place, which can cause bugs with React state and props. Use `.toSorted()` to create a new sorted array without mutation.
-
-**Incorrect: mutates original array**
-
-```typescript
-function UserList({ users }: { users: User[] }) {
-  // Mutates the users prop array!
-  const sorted = useMemo(
-    () => users.sort((a, b) => a.name.localeCompare(b.name)),
-    [users]
-  )
-  return <div>{sorted.map(renderUser)}</div>
-}
-```
-
-**Correct: creates new array**
-
-```typescript
-function UserList({ users }: { users: User[] }) {
-  // Creates new sorted array, original unchanged
-  const sorted = useMemo(
-    () => users.toSorted((a, b) => a.name.localeCompare(b.name)),
-    [users]
-  )
-  return <div>{sorted.map(renderUser)}</div>
-}
-```
-
-**Why this matters in React:**
-
-1. Props/state mutations break React's immutability model - React expects props and state to be treated as read-only
-
-2. Causes stale closure bugs - Mutating arrays inside closures (callbacks, effects) can lead to unexpected behavior
-
-**Browser support: fallback for older browsers**
-
-```typescript
-// Fallback for older browsers
-const sorted = [...items].sort((a, b) => a.value - b.value)
-```
-
-`.toSorted()` is available in all modern browsers (Chrome 110+, Safari 16+, Firefox 115+, Node.js 20+). For older environments, use spread operator:
-
-**Other immutable array methods:**
-
-- `.toSorted()` - immutable sort
-
-- `.toReversed()` - immutable reverse
-
-- `.toSpliced()` - immutable splice
-
-- `.with()` - immutable element replacement
-
----
-
-## 8. Advanced Patterns
-
-**Impact: LOW**
-
-Advanced patterns for specific cases that require careful implementation.
-
-### 8.1 Store Event Handlers in Refs
-
-**Impact: LOW (stable subscriptions)**
-
-Store callbacks in refs when used in effects that shouldn't re-subscribe on callback changes. Prefer `ahooks` hooks which handle this internally.
-
-**Incorrect: re-subscribes on every render**
-
-```tsx
-function useWindowEvent(event: string, handler: () => void) {
-  useEffect(() => {
-    window.addEventListener(event, handler)
-    return () => window.removeEventListener(event, handler)
-  }, [event, handler])
-}
-```
-
-**Correct: use ahooks useEventListener**
-
-```tsx
-import { useEventListener } from 'ahooks'
-
-function Component() {
-  // Handler is stored in a ref internally - no re-subscription on handler change
-  useEventListener('resize', () => {
-    console.log('Window resized')
-  })
-}
-```
-
-**Alternative: use `useEffectEvent` for custom hooks**
-
-```tsx
-import { useEffectEvent } from 'react'
-
-function useWindowEvent(event: string, handler: () => void) {
-  const onEvent = useEffectEvent(handler)
-
-  useEffect(() => {
-    window.addEventListener(event, onEvent)
-    return () => window.removeEventListener(event, onEvent)
-  }, [event])
-}
-```
-
-`useEffectEvent` provides a cleaner API for the same pattern: it creates a stable function reference that always calls the latest version of the handler.
-
-### 8.2 useLatest for Stable Callback Refs
-
-**Impact: LOW (prevents effect re-runs)**
-
-Access latest values in callbacks without adding them to dependency arrays. Prevents effect re-runs while avoiding stale closures. Use `useLatest` from `ahooks`.
-
-**Incorrect: effect re-runs on every callback change**
-
-```tsx
-function SearchInput({ onSearch }: { onSearch: (q: string) => void }) {
-  const [query, setQuery] = useState('')
-
-  useEffect(() => {
-    const timeout = setTimeout(() => onSearch(query), 300)
-    return () => clearTimeout(timeout)
-  }, [query, onSearch])
-}
-```
-
-**Correct: stable effect, fresh callback with ahooks**
-
-```tsx
-import { useLatest } from 'ahooks'
-
-function SearchInput({ onSearch }: { onSearch: (q: string) => void }) {
-  const [query, setQuery] = useState('')
-  const onSearchRef = useLatest(onSearch)
-
-  useEffect(() => {
-    const timeout = setTimeout(() => onSearchRef.current(query), 300)
-    return () => clearTimeout(timeout)
-  }, [query])
-}
-```
-
-**Alternative: use useDebounceFn for this specific pattern**
-
-```tsx
-import { useDebounceFn } from 'ahooks'
-
-function SearchInput({ onSearch }: { onSearch: (q: string) => void }) {
-  const [query, setQuery] = useState('')
-  const { run: debouncedSearch } = useDebounceFn(onSearch, { wait: 300 })
-
-  useEffect(() => {
-    if (query) {
-      debouncedSearch(query)
-    }
-  }, [query, debouncedSearch])
-}
-```
-
-For debounced search specifically, `useDebounceFn` provides a cleaner solution.
-
----
-
-## References
-
-1. [https://react.dev](https://react.dev)
-2. [https://nextjs.org](https://nextjs.org)
-3. [https://tanstack.com/query](https://tanstack.com/query)
-4. [https://github.com/shuding/better-all](https://github.com/shuding/better-all)
-5. [https://ahooks.js.org](https://ahooks.js.org) - ahooks React hooks library
-
diff --git a/.agents/skills/react-best-practices/SKILL.md b/.agents/skills/react-best-practices/SKILL.md
deleted file mode 100644
index 6d3d090..0000000
--- a/.agents/skills/react-best-practices/SKILL.md
+++ /dev/null
@@ -1,143 +0,0 @@
----
-name: react-best-practices
-description: React and Next.js performance optimization guidelines tuned by gracefullight, forked from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
-license: MIT
-metadata:
-  author: gracefullight
-  version: "2.0.0"
-  forked_from: vercel
----
-
-# React Best Practices
-
-Comprehensive performance optimization guide for React and Next.js applications, tuned by gracefullight (forked from Vercel Engineering). Contains 42 rules across 8 categories (some rules are enforced by Biome linter), prioritized by impact to guide automated refactoring and code generation.
-
-## Project-Specific Notes
-
-This project uses **Orval + React Query (@tanstack/react-query)** for API layer:
-- Orval generates type-safe React Query hooks from OpenAPI specs
-- **Always use Orval-generated hooks in Client Components** instead of RSC data fetching
-- React Query handles caching, deduplication, and devtools
-- RSC Components should handle layout, SEO metadata, and pass static props only
-
-**React Compiler is enabled** (`reactCompiler: true` in next.config.ts):
-- React Compiler automatically handles memoization (useMemo, useCallback, React.memo)
-- Only use manual memoization when profiling a bottleneck or for genuinely expensive computations
-
-## When to Apply
-
-Reference these guidelines when:
-- Writing new React components or Next.js pages
-- Implementing data fetching (client or server-side)
-- Reviewing code for performance issues
-- Refactoring existing React/Next.js code
-- Optimizing bundle size or load times
-
-## Rule Categories by Priority
-
-| Priority | Category | Impact | Prefix |
-|----------|----------|--------|--------|
-| 1 | Eliminating Waterfalls | CRITICAL | `async-` |
-| 2 | Bundle Size Optimization | CRITICAL | `bundle-` |
-| 3 | Server-Side Performance | HIGH | `server-` |
-| 4 | Client-Side Data Fetching | MEDIUM-HIGH | `client-` |
-| 5 | Re-render Optimization | MEDIUM | `rerender-` |
-| 6 | Rendering Performance | MEDIUM | `rendering-` |
-| 7 | JavaScript Performance | LOW-MEDIUM | `js-` |
-| 8 | Advanced Patterns | LOW | `advanced-` |
-
-## Quick Reference
-
-### 1. Eliminating Waterfalls (CRITICAL)
-
-- `async-defer-await` - Move await into branches where actually used
-- `async-parallel` - Use Promise.all() for independent operations
-- `async-dependencies` - Use better-all for partial dependencies
-- `async-api-routes` - Start promises early, await late in API routes
-- `async-suspense-boundaries` - Use Suspense to stream content
-
-### 2. Bundle Size Optimization (CRITICAL)
-
-- `bundle-dynamic-imports` - Use next/dynamic for heavy components
-- `bundle-defer-third-party` - Load analytics/logging after hydration
-- `bundle-conditional` - Load modules only when feature is activated
-- `bundle-preload` - Preload on hover/focus for perceived speed
-
-> Note: Barrel file imports are enforced by Biome linter (`noBarrelFile`, `noReExportAll`)
-
-### 3. Server-Side Performance (HIGH)
-
-- `server-after-nonblocking` - Use after() for non-blocking operations
-
-> Note: RSC data fetching rules are excluded. This project uses Orval + React Query for API integration.
-
-### 4. Client-Side Data Fetching (MEDIUM-HIGH)
-
-- `client-react-compiler-optimal` - React Compiler handles memoization, only use useMemo/useCallback when profiling bottlenecks
-- `client-orval-pattern` - **Always use Orval-generated hooks for API data fetching**
-- `client-tanstack-query-dedup` - Use @tanstack/query for automatic request deduplication
-- `client-event-listeners` - Deduplicate global event listeners
-
-> **IMPORTANT**: Do NOT use RSC async data fetching in this project. Use Orval-generated React Query hooks instead.
-
-### 5. Re-render Optimization (MEDIUM)
-
-- `rerender-defer-reads` - Don't subscribe to state only used in callbacks
-- `rerender-memo` - Extract expensive work into memoized components
-- `rerender-dependencies` - Use primitive dependencies in effects
-- `rerender-derived-state` - Subscribe to derived booleans, not raw values
-- `rerender-functional-setstate` - Use functional setState for stable callbacks
-- `rerender-lazy-state-init` - Pass function to useState for expensive values
-- `rerender-transitions` - Use startTransition for non-urgent updates
-
-### 6. Rendering Performance (MEDIUM)
-
-- `rendering-animate-svg-wrapper` - Animate div wrapper, not SVG element
-- `rendering-content-visibility` - Use content-visibility for long lists
-- `rendering-hoist-jsx` - Extract static JSX outside components
-- `rendering-svg-precision` - Reduce SVG coordinate precision
-- `rendering-hydration-no-flicker` - Use inline script for client-only data
-- `rendering-activity` - Use Activity component for show/hide
-
-> Note: Conditional rendering with `&&` is enforced by Biome linter (`noLeakedRender`)
-
-### 7. JavaScript Performance (LOW-MEDIUM)
-
-- `js-batch-dom-css` - Group CSS changes via classes or cssText
-- `js-index-maps` - Build Map for repeated lookups
-- `js-cache-property-access` - Cache object properties in loops
-- `js-cache-function-results` - Cache function results in module-level Map
-- `js-cache-storage` - Cache localStorage/sessionStorage reads
-- `js-combine-iterations` - Combine multiple filter/map into one loop
-- `js-length-check-first` - Check array length before expensive comparison
-- `js-early-exit` - Return early from functions
-- `js-min-max-loop` - Use loop for min/max instead of sort
-- `js-set-map-lookups` - Use Set/Map for O(1) lookups
-- `js-tosorted-immutable` - Use toSorted() for immutability
-
-> Note: RegExp hoisting is enforced by Biome linter (`useTopLevelRegex`)
-
-### 8. Advanced Patterns (LOW)
-
-- `advanced-event-handler-refs` - Store event handlers in refs
-- `advanced-use-latest` - useLatest for stable callback refs
-
-## How to Use
-
-Read individual rule files for detailed explanations and code examples:
-
-```
-rules/async-parallel.md
-rules/bundle-dynamic-imports.md
-rules/_sections.md
-```
-
-Each rule file contains:
-- Brief explanation of why it matters
-- Incorrect code example with explanation
-- Correct code example with explanation
-- Additional context and references
-
-## Full Compiled Document
-
-For complete guide with all rules expanded: `AGENTS.md`
diff --git a/.agents/skills/react-best-practices/rules/_sections.md b/.agents/skills/react-best-practices/rules/_sections.md
deleted file mode 100644
index 4d20c14..0000000
--- a/.agents/skills/react-best-practices/rules/_sections.md
+++ /dev/null
@@ -1,46 +0,0 @@
-# Sections
-
-This file defines all sections, their ordering, impact levels, and descriptions.
-The section ID (in parentheses) is the filename prefix used to group rules.
-
----
-
-## 1. Eliminating Waterfalls (async)
-
-**Impact:** CRITICAL  
-**Description:** Waterfalls are the #1 performance killer. Each sequential await adds full network latency. Eliminating them yields the largest gains.
-
-## 2. Bundle Size Optimization (bundle)
-
-**Impact:** CRITICAL  
-**Description:** Reducing initial bundle size improves Time to Interactive and Largest Contentful Paint.
-
-## 3. Server-Side Performance (server)
-
-**Impact:** HIGH  
-**Description:** Optimizing server-side rendering and data fetching eliminates server-side waterfalls and reduces response times.
-
-## 4. Client-Side Data Fetching (client)
-
-**Impact:** MEDIUM-HIGH  
-**Description:** Automatic deduplication and efficient data fetching patterns reduce redundant network requests.
-
-## 5. Re-render Optimization (rerender)
-
-**Impact:** MEDIUM  
-**Description:** Reducing unnecessary re-renders minimizes wasted computation and improves UI responsiveness.
-
-## 6. Rendering Performance (rendering)
-
-**Impact:** MEDIUM  
-**Description:** Optimizing the rendering process reduces the work the browser needs to do.
-
-## 7. JavaScript Performance (js)
-
-**Impact:** LOW-MEDIUM  
-**Description:** Micro-optimizations for hot paths can add up to meaningful improvements.
-
-## 8. Advanced Patterns (advanced)
-
-**Impact:** LOW  
-**Description:** Advanced patterns for specific cases that require careful implementation.
diff --git a/.agents/skills/react-best-practices/rules/_template.md b/.agents/skills/react-best-practices/rules/_template.md
deleted file mode 100644
index 1e9e707..0000000
--- a/.agents/skills/react-best-practices/rules/_template.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-title: Rule Title Here
-impact: MEDIUM
-impactDescription: Optional description of impact (e.g., "20-50% improvement")
-tags: tag1, tag2
----
-
-## Rule Title Here
-
-**Impact: MEDIUM (optional impact description)**
-
-Brief explanation of the rule and why it matters. This should be clear and concise, explaining the performance implications.
-
-**Incorrect (description of what's wrong):**
-
-```typescript
-// Bad code example here
-const bad = example()
-```
-
-**Correct (description of what's right):**
-
-```typescript
-// Good code example here
-const good = example()
-```
-
-Reference: [Link to documentation or resource](https://example.com)
diff --git a/.agents/skills/react-best-practices/rules/advanced-event-handler-refs.md b/.agents/skills/react-best-practices/rules/advanced-event-handler-refs.md
deleted file mode 100644
index 340e8f8..0000000
--- a/.agents/skills/react-best-practices/rules/advanced-event-handler-refs.md
+++ /dev/null
@@ -1,78 +0,0 @@
----
-title: Store Event Handlers in Refs
-impact: LOW
-impactDescription: stable subscriptions
-tags: advanced, hooks, refs, event-handlers, optimization
----
-
-## Store Event Handlers in Refs
-
-Store callbacks in refs when used in effects that shouldn't re-subscribe on callback changes.
-
-**Recommended: use `@reactuses/core`:**
-
-```tsx
-import { useEventListener } from "@reactuses/core";
-
-function Profile() {
-  const handleScroll = () => {
-    console.log("Window scrolled!");
-  };
-
-  // Automatically handles stable subscriptions and cleanup
-  useEventListener("scroll", handleScroll);
-
-  return <div>Scroll to see console output</div>;
-}
-```
-
-`useEventListener` from `@reactuses/core` handles ref-based handler management internally, ensuring stable subscriptions without re-subscribing on handler changes.
-
----
-
-**Manual approach (if not using a library):**
-
-**Incorrect (re-subscribes on every render):**
-
-```tsx
-function useWindowEvent(event: string, handler: () => void) {
-  useEffect(() => {
-    window.addEventListener(event, handler);
-    return () => window.removeEventListener(event, handler);
-  }, [event, handler]);
-}
-```
-
-**Correct (stable subscription):**
-
-```tsx
-function useWindowEvent(event: string, handler: () => void) {
-  const handlerRef = useRef(handler);
-  useEffect(() => {
-    handlerRef.current = handler;
-  }, [handler]);
-
-  useEffect(() => {
-    const listener = () => handlerRef.current();
-    window.addEventListener(event, listener);
-    return () => window.removeEventListener(event, listener);
-  }, [event]);
-}
-```
-
-**Alternative: use `useEffectEvent` if you're on latest React:**
-
-```tsx
-import { useEffectEvent } from "react";
-
-function useWindowEvent(event: string, handler: () => void) {
-  const onEvent = useEffectEvent(handler);
-
-  useEffect(() => {
-    window.addEventListener(event, onEvent);
-    return () => window.removeEventListener(event, onEvent);
-  }, [event]);
-}
-```
-
-`useEffectEvent` provides a cleaner API for the same pattern: it creates a stable function reference that always calls the latest version of the handler.
diff --git a/.agents/skills/react-best-practices/rules/advanced-use-latest.md b/.agents/skills/react-best-practices/rules/advanced-use-latest.md
deleted file mode 100644
index 3facdf2..0000000
--- a/.agents/skills/react-best-practices/rules/advanced-use-latest.md
+++ /dev/null
@@ -1,49 +0,0 @@
----
-title: useLatest for Stable Callback Refs
-impact: LOW
-impactDescription: prevents effect re-runs
-tags: advanced, hooks, useLatest, refs, optimization
----
-
-## useLatest for Stable Callback Refs
-
-Access latest values in callbacks without adding them to dependency arrays. Prevents effect re-runs while avoiding stale closures.
-
-**Implementation:**
-
-```typescript
-function useLatest<T>(value: T) {
-  const ref = useRef(value)
-  useEffect(() => {
-    ref.current = value
-  }, [value])
-  return ref
-}
-```
-
-**Incorrect (effect re-runs on every callback change):**
-
-```tsx
-function SearchInput({ onSearch }: { onSearch: (q: string) => void }) {
-  const [query, setQuery] = useState('')
-
-  useEffect(() => {
-    const timeout = setTimeout(() => onSearch(query), 300)
-    return () => clearTimeout(timeout)
-  }, [query, onSearch])
-}
-```
-
-**Correct (stable effect, fresh callback):**
-
-```tsx
-function SearchInput({ onSearch }: { onSearch: (q: string) => void }) {
-  const [query, setQuery] = useState('')
-  const onSearchRef = useLatest(onSearch)
-
-  useEffect(() => {
-    const timeout = setTimeout(() => onSearchRef.current(query), 300)
-    return () => clearTimeout(timeout)
-  }, [query])
-}
-```
diff --git a/.agents/skills/react-best-practices/rules/async-api-routes.md b/.agents/skills/react-best-practices/rules/async-api-routes.md
deleted file mode 100644
index 6feda1e..0000000
--- a/.agents/skills/react-best-practices/rules/async-api-routes.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-title: Prevent Waterfall Chains in API Routes
-impact: CRITICAL
-impactDescription: 2-10× improvement
-tags: api-routes, server-actions, waterfalls, parallelization
----
-
-## Prevent Waterfall Chains in API Routes
-
-In API routes and Server Actions, start independent operations immediately, even if you don't await them yet.
-
-**Incorrect (config waits for auth, data waits for both):**
-
-```typescript
-export async function GET(request: Request) {
-  const session = await auth()
-  const config = await fetchConfig()
-  const data = await fetchData(session.user.id)
-  return Response.json({ data, config })
-}
-```
-
-**Correct (auth and config start immediately):**
-
-```typescript
-export async function GET(request: Request) {
-  const sessionPromise = auth()
-  const configPromise = fetchConfig()
-  const session = await sessionPromise
-  const [config, data] = await Promise.all([
-    configPromise,
-    fetchData(session.user.id)
-  ])
-  return Response.json({ data, config })
-}
-```
-
-For operations with more complex dependency chains, use `better-all` to automatically maximize parallelism (see Dependency-Based Parallelization).
diff --git a/.agents/skills/react-best-practices/rules/async-defer-await.md b/.agents/skills/react-best-practices/rules/async-defer-await.md
deleted file mode 100644
index ea7082a..0000000
--- a/.agents/skills/react-best-practices/rules/async-defer-await.md
+++ /dev/null
@@ -1,80 +0,0 @@
----
-title: Defer Await Until Needed
-impact: HIGH
-impactDescription: avoids blocking unused code paths
-tags: async, await, conditional, optimization
----
-
-## Defer Await Until Needed
-
-Move `await` operations into the branches where they're actually used to avoid blocking code paths that don't need them.
-
-**Incorrect (blocks both branches):**
-
-```typescript
-async function handleRequest(userId: string, skipProcessing: boolean) {
-  const userData = await fetchUserData(userId)
-  
-  if (skipProcessing) {
-    // Returns immediately but still waited for userData
-    return { skipped: true }
-  }
-  
-  // Only this branch uses userData
-  return processUserData(userData)
-}
-```
-
-**Correct (only blocks when needed):**
-
-```typescript
-async function handleRequest(userId: string, skipProcessing: boolean) {
-  if (skipProcessing) {
-    // Returns immediately without waiting
-    return { skipped: true }
-  }
-  
-  // Fetch only when needed
-  const userData = await fetchUserData(userId)
-  return processUserData(userData)
-}
-```
-
-**Another example (early return optimization):**
-
-```typescript
-// Incorrect: always fetches permissions
-async function updateResource(resourceId: string, userId: string) {
-  const permissions = await fetchPermissions(userId)
-  const resource = await getResource(resourceId)
-  
-  if (!resource) {
-    return { error: 'Not found' }
-  }
-  
-  if (!permissions.canEdit) {
-    return { error: 'Forbidden' }
-  }
-  
-  return await updateResourceData(resource, permissions)
-}
-
-// Correct: fetches only when needed
-async function updateResource(resourceId: string, userId: string) {
-  const resource = await getResource(resourceId)
-  
-  if (!resource) {
-    return { error: 'Not found' }
-  }
-  
-  const permissions = await fetchPermissions(userId)
-  
-  if (!permissions.canEdit) {
-    return { error: 'Forbidden' }
-  }
-  
-  return await updateResourceData(resource, permissions)
-}
-```
-
-This optimization is especially valuable when the skipped branch is frequently taken, or when the deferred operation is expensive.
diff --git a/.agents/skills/react-best-practices/rules/async-dependencies.md b/.agents/skills/react-best-practices/rules/async-dependencies.md
deleted file mode 100644
index fb90d86..0000000
--- a/.agents/skills/react-best-practices/rules/async-dependencies.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-title: Dependency-Based Parallelization
-impact: CRITICAL
-impactDescription: 2-10× improvement
-tags: async, parallelization, dependencies, better-all
----
-
-## Dependency-Based Parallelization
-
-For operations with partial dependencies, use `better-all` to maximize parallelism. It automatically starts each task at the earliest possible moment.
-
-**Incorrect (profile waits for config unnecessarily):**
-
-```typescript
-const [user, config] = await Promise.all([
-  fetchUser(),
-  fetchConfig()
-])
-const profile = await fetchProfile(user.id)
-```
-
-**Correct (config and profile run in parallel):**
-
-```typescript
-import { all } from 'better-all'
-
-const { user, config, profile } = await all({
-  async user() { return fetchUser() },
-  async config() { return fetchConfig() },
-  async profile() {
-    return fetchProfile((await this.$.user).id)
-  }
-})
-```
-
-Reference: [https://github.com/shuding/better-all](https://github.com/shuding/better-all)
diff --git a/.agents/skills/react-best-practices/rules/async-parallel.md b/.agents/skills/react-best-practices/rules/async-parallel.md
deleted file mode 100644
index 64133f6..0000000
--- a/.agents/skills/react-best-practices/rules/async-parallel.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-title: Promise.all() for Independent Operations
-impact: CRITICAL
-impactDescription: 2-10× improvement
-tags: async, parallelization, promises, waterfalls
----
-
-## Promise.all() for Independent Operations
-
-When async operations have no interdependencies, execute them concurrently using `Promise.all()`.
-
-**Incorrect (sequential execution, 3 round trips):**
-
-```typescript
-const user = await fetchUser()
-const posts = await fetchPosts()
-const comments = await fetchComments()
-```
-
-**Correct (parallel execution, 1 round trip):**
-
-```typescript
-const [user, posts, comments] = await Promise.all([
-  fetchUser(),
-  fetchPosts(),
-  fetchComments()
-])
-```
diff --git a/.agents/skills/react-best-practices/rules/async-suspense-boundaries.md b/.agents/skills/react-best-practices/rules/async-suspense-boundaries.md
deleted file mode 100644
index 1fbc05b..0000000
--- a/.agents/skills/react-best-practices/rules/async-suspense-boundaries.md
+++ /dev/null
@@ -1,99 +0,0 @@
----
-title: Strategic Suspense Boundaries
-impact: HIGH
-impactDescription: faster initial paint
-tags: async, suspense, streaming, layout-shift
----
-
-## Strategic Suspense Boundaries
-
-Instead of awaiting data in async components before returning JSX, use Suspense boundaries to show the wrapper UI faster while data loads.
-
-**Incorrect (wrapper blocked by data fetching):**
-
-```tsx
-async function Page() {
-  const data = await fetchData() // Blocks entire page
-  
-  return (
-    <div>
-      <div>Sidebar</div>
-      <div>Header</div>
-      <div>
-        <DataDisplay data={data} />
-      </div>
-      <div>Footer</div>
-    </div>
-  )
-}
-```
-
-The entire layout waits for data even though only the middle section needs it.
-
-**Correct (wrapper shows immediately, data streams in):**
-
-```tsx
-function Page() {
-  return (
-    <div>
-      <div>Sidebar</div>
-      <div>Header</div>
-      <div>
-        <Suspense fallback={<Skeleton />}>
-          <DataDisplay />
-        </Suspense>
-      </div>
-      <div>Footer</div>
-    </div>
-  )
-}
-
-async function DataDisplay() {
-  const data = await fetchData() // Only blocks this component
-  return <div>{data.content}</div>
-}
-```
-
-Sidebar, Header, and Footer render immediately. Only DataDisplay waits for data.
-
-**Alternative (share promise across components):**
-
-```tsx
-function Page() {
-  // Start fetch immediately, but don't await
-  const dataPromise = fetchData()
-  
-  return (
-    <div>
-      <div>Sidebar</div>
-      <div>Header</div>
-      <Suspense fallback={<Skeleton />}>
-        <DataDisplay dataPromise={dataPromise} />
-        <DataSummary dataPromise={dataPromise} />
-      </Suspense>
-      <div>Footer</div>
-    </div>
-  )
-}
-
-function DataDisplay({ dataPromise }: { dataPromise: Promise<Data> }) {
-  const data = use(dataPromise) // Unwraps the promise
-  return <div>{data.content}</div>
-}
-
-function DataSummary({ dataPromise }: { dataPromise: Promise<Data> }) {
-  const data = use(dataPromise) // Reuses the same promise
-  return <div>{data.summary}</div>
-}
-```
-
-Both components share the same promise, so only one fetch occurs. Layout renders immediately while both components wait together.
-
-**When NOT to use this pattern:**
-
-- Critical data needed for layout decisions (affects positioning)
-- SEO-critical content above the fold
-- Small, fast queries where suspense overhead isn't worth it
-- When you want to avoid layout shift (loading → content jump)
-
-**Trade-off:** Faster initial paint vs potential layout shift. Choose based on your UX priorities.
diff --git a/.agents/skills/react-best-practices/rules/bundle-conditional.md b/.agents/skills/react-best-practices/rules/bundle-conditional.md
deleted file mode 100644
index 40bd6f9..0000000
--- a/.agents/skills/react-best-practices/rules/bundle-conditional.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-title: Conditional Module Loading
-impact: HIGH
-impactDescription: loads large data only when needed
-tags: bundle, conditional-loading, lazy-loading
----
-
-## Conditional Module Loading
-
-Load large data or modules only when a feature is activated.
-
-**Example (lazy-load animation frames):**
-
-```tsx
-function AnimationPlayer({ enabled }: { enabled: boolean }) {
-  const [frames, setFrames] = useState<Frame[] | null>(null)
-
-  useEffect(() => {
-    if (enabled && !frames && typeof window !== 'undefined') {
-      import('./animation-frames.js')
-        .then(mod => setFrames(mod.frames))
-        .catch(() => setEnabled(false))
-    }
-  }, [enabled, frames])
-
-  if (!frames) return <Skeleton />
-  return <Canvas frames={frames} />
-}
-```
-
-The `typeof window !== 'undefined'` check prevents bundling this module for SSR, optimizing server bundle size and build speed.
diff --git a/.agents/skills/react-best-practices/rules/bundle-defer-third-party.md b/.agents/skills/react-best-practices/rules/bundle-defer-third-party.md
deleted file mode 100644
index db041d1..0000000
--- a/.agents/skills/react-best-practices/rules/bundle-defer-third-party.md
+++ /dev/null
@@ -1,49 +0,0 @@
----
-title: Defer Non-Critical Third-Party Libraries
-impact: MEDIUM
-impactDescription: loads after hydration
-tags: bundle, third-party, analytics, defer
----
-
-## Defer Non-Critical Third-Party Libraries
-
-Analytics, logging, and error tracking don't block user interaction. Load them after hydration.
-
-**Incorrect (blocks initial bundle):**
-
-```tsx
-import { Analytics } from '@vercel/analytics/react'
-
-export default function RootLayout({ children }) {
-  return (
-    <html>
-      <body>
-        {children}
-        <Analytics />
-      </body>
-    </html>
-  )
-}
-```
-
-**Correct (loads after hydration):**
-
-```tsx
-import dynamic from 'next/dynamic'
-
-const Analytics = dynamic(
-  () => import('@vercel/analytics/react').then(m => m.Analytics),
-  { ssr: false }
-)
-
-export default function RootLayout({ children }) {
-  return (
-    <html>
-      <body>
-        {children}
-        <Analytics />
-      </body>
-    </html>
-  )
-}
-```
diff --git a/.agents/skills/react-best-practices/rules/bundle-dynamic-imports.md b/.agents/skills/react-best-practices/rules/bundle-dynamic-imports.md
deleted file mode 100644
index 60b6269..0000000
--- a/.agents/skills/react-best-practices/rules/bundle-dynamic-imports.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-title: Dynamic Imports for Heavy Components
-impact: CRITICAL
-impactDescription: directly affects TTI and LCP
-tags: bundle, dynamic-import, code-splitting, next-dynamic
----
-
-## Dynamic Imports for Heavy Components
-
-Use `next/dynamic` to lazy-load large components not needed on initial render.
-
-**Incorrect (Monaco bundles with main chunk ~300KB):**
-
-```tsx
-import { MonacoEditor } from './monaco-editor'
-
-function CodePanel({ code }: { code: string }) {
-  return <MonacoEditor value={code} />
-}
-```
-
-**Correct (Monaco loads on demand):**
-
-```tsx
-import dynamic from 'next/dynamic'
-
-const MonacoEditor = dynamic(
-  () => import('./monaco-editor').then(m => m.MonacoEditor),
-  { ssr: false }
-)
-
-function CodePanel({ code }: { code: string }) {
-  return <MonacoEditor value={code} />
-}
-```
diff --git a/.agents/skills/react-best-practices/rules/bundle-preload.md b/.agents/skills/react-best-practices/rules/bundle-preload.md
deleted file mode 100644
index 7000504..0000000
--- a/.agents/skills/react-best-practices/rules/bundle-preload.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-title: Preload Based on User Intent
-impact: MEDIUM
-impactDescription: reduces perceived latency
-tags: bundle, preload, user-intent, hover
----
-
-## Preload Based on User Intent
-
-Preload heavy bundles before they're needed to reduce perceived latency.
-
-**Example (preload on hover/focus):**
-
-```tsx
-function EditorButton({ onClick }: { onClick: () => void }) {
-  const preload = () => {
-    if (typeof window !== 'undefined') {
-      void import('./monaco-editor')
-    }
-  }
-
-  return (
-    <button
-      onMouseEnter={preload}
-      onFocus={preload}
-      onClick={onClick}
-    >
-      Open Editor
-    </button>
-  )
-}
-```
-
-**Example (preload when feature flag is enabled):**
-
-```tsx
-function FlagsProvider({ children, flags }: Props) {
-  useEffect(() => {
-    if (flags.editorEnabled && typeof window !== 'undefined') {
-      void import('./monaco-editor').then(mod => mod.init())
-    }
-  }, [flags.editorEnabled])
-
-  return <FlagsContext.Provider value={flags}>
-    {children}
-  </FlagsContext.Provider>
-}
-```
-
-The `typeof window !== 'undefined'` check prevents bundling preloaded modules for SSR, optimizing server bundle size and build speed.
diff --git a/.agents/skills/react-best-practices/rules/client-event-listeners.md b/.agents/skills/react-best-practices/rules/client-event-listeners.md
deleted file mode 100644
index f7b5a81..0000000
--- a/.agents/skills/react-best-practices/rules/client-event-listeners.md
+++ /dev/null
@@ -1,111 +0,0 @@
----
-title: Deduplicate Global Event Listeners
-impact: LOW
-impactDescription: single listener for N components
-tags: client, event-listeners, subscription, optimization
----
-
-## Deduplicate Global Event Listeners
-
-Use a library-based approach or module-level subscription pattern to share global event listeners across component instances.
-
-**Recommended: use `@reactuses/core`:**
-
-```tsx
-import { useEventListener } from "@reactuses/core";
-
-function Profile() {
-  const handleKeyDown = (e: KeyboardEvent) => {
-    if (e.metaKey && e.key === "p") {
-      console.log("Meta+P pressed!");
-    }
-    if (e.metaKey && e.key === "k") {
-      console.log("Meta+K pressed!");
-    }
-  };
-
-  // Single listener with stable subscription and automatic cleanup
-  useEventListener("keydown", handleKeyDown);
-
-  return <div>Press Meta+P or Meta+K</div>;
-}
-```
-
-`useEventListener` from `@reactuses/core` handles event subscription with proper cleanup. For multiple shortcuts, consolidate handlers into a single listener to avoid N listeners for N hooks.
-
----
-
-**Manual approach (if not using a library):**
-
-**Incorrect (N instances = N listeners):**
-
-```tsx
-function useKeyboardShortcut(key: string, callback: () => void) {
-  useEffect(() => {
-    const handler = (e: KeyboardEvent) => {
-      if (e.metaKey && e.key === key) {
-        callback();
-      }
-    };
-    window.addEventListener("keydown", handler);
-    return () => window.removeEventListener("keydown", handler);
-  }, [key, callback]);
-}
-```
-
-When using the `useKeyboardShortcut` hook multiple times, each instance will register a new listener.
-
-**Correct (N instances = 1 listener):**
-
-```tsx
-// Module-level Map to track callbacks per key
-const keyCallbacks = new Map<string, Set<() => void>>();
-let isListenerAttached = false;
-
-function attachGlobalListener() {
-  if (isListenerAttached) return;
-  isListenerAttached = true;
-
-  window.addEventListener("keydown", (e: KeyboardEvent) => {
-    if (e.metaKey && keyCallbacks.has(e.key)) {
-      keyCallbacks.get(e.key)!.forEach((cb) => cb());
-    }
-  });
-}
-
-function useKeyboardShortcut(key: string, callback: () => void) {
-  useEffect(() => {
-    attachGlobalListener();
-
-    if (!keyCallbacks.has(key)) {
-      keyCallbacks.set(key, new Set());
-    }
-    keyCallbacks.get(key)!.add(callback);
-
-    return () => {
-      const set = keyCallbacks.get(key);
-      if (set) {
-        set.delete(callback);
-        if (set.size === 0) {
-          keyCallbacks.delete(key);
-        }
-      }
-    };
-  }, [key, callback]);
-}
-
-function Profile() {
-  // Multiple shortcuts will share the same listener
-  useKeyboardShortcut("p", () => {
-    /* ... */
-  });
-  useKeyboardShortcut("k", () => {
-    /* ... */
-  });
-  // ...
-}
-```
-
-**Alternative with @tanstack/query subscription:**
-
-For more complex subscription patterns with automatic cleanup and React Query integration, consider using the `useQuery` with `refetchInterval` or external subscription management.
diff --git a/.agents/skills/react-best-practices/rules/client-orval-pattern.md b/.agents/skills/react-best-practices/rules/client-orval-pattern.md
deleted file mode 100644
index 69ecb3b..0000000
--- a/.agents/skills/react-best-practices/rules/client-orval-pattern.md
+++ /dev/null
@@ -1,116 +0,0 @@
----
-title: Use Orval-Generated Hooks for API Data Fetching
-impact: HIGH
-impactDescription: consistent API layer, type-safe, debuggable
-tags: client, orval, react-query, api, data-fetching
----
-
-## Use Orval-Generated Hooks for API Data Fetching
-
-This project uses Orval to generate type-safe React Query hooks from OpenAPI specs. **Always use these generated hooks instead of RSC data fetching or manual fetch calls.**
-
-### Why NOT to use RSC data fetching in this project:
-
-1. **Duplicate API layer** - Orval already generates a complete, type-safe API client
-2. **Debugging difficulty** - Server-side errors in RSC are harder to trace than client-side React Query errors
-3. **Inconsistent patterns** - Mixing RSC fetch with React Query creates confusion
-4. **Lost features** - React Query's caching, deduplication, optimistic updates, and devtools are unavailable in RSC
-
-### Correct Pattern:
-
-```tsx
-// Use Orval-generated hooks in Client Components
-"use client";
-
-import { useGetUsers, useCreateUser } from "@/lib/api/generated";
-
-export function UserList() {
-  const { data: users, isLoading, error } = useGetUsers();
-  
-  if (isLoading) return <Skeleton />;
-  if (error) return <ErrorMessage error={error} />;
-  
-  return <ul>{users?.map(user => <UserItem key={user.id} user={user} />)}</ul>;
-}
-```
-
-### Incorrect Patterns:
-
-```tsx
-// Don't use RSC async data fetching
-async function UserList() {
-  const users = await fetch("/api/users").then(r => r.json());
-  return <ul>{users.map(user => <UserItem key={user.id} user={user} />)}</ul>;
-}
-
-// Don't use manual fetch in useEffect
-function UserList() {
-  const [users, setUsers] = useState([]);
-  useEffect(() => {
-    fetch("/api/users").then(r => r.json()).then(setUsers);
-  }, []);
-  return <ul>{users.map(user => ...)}</ul>;
-}
-
-// Don't bypass Orval with direct axios calls
-function UserList() {
-  const { data } = useQuery({
-    queryKey: ["users"],
-    queryFn: () => axios.get("/api/users"), // Use generated hooks instead
-  });
-}
-```
-
-### For Mutations:
-
-```tsx
-"use client";
-
-import { useCreateUser } from "@/lib/api/generated";
-
-export function CreateUserForm() {
-  const { mutate, isPending } = useCreateUser();
-  
-  const handleSubmit = (data: CreateUserInput) => {
-    mutate({ data }, {
-      onSuccess: () => toast.success("User created"),
-      onError: (error) => toast.error(error.message),
-    });
-  };
-  
-  return <form onSubmit={handleSubmit}>...</form>;
-}
-```
-
-### For Suspense:
-
-Use the generated Suspense hooks (if `useSuspenseQuery: true` in orval.config.ts):
-
-```tsx
-"use client";
-
-import { useGetUsersSuspense } from "@/lib/api/generated";
-import { Suspense } from "react";
-
-function UserListContent() {
-  const { data: users } = useGetUsersSuspense();
-  return <ul>{users.map(user => <UserItem key={user.id} user={user} />)}</ul>;
-}
-
-export function UserList() {
-  return (
-    <Suspense fallback={<Skeleton />}>
-      <UserListContent />
-    </Suspense>
-  );
-}
-```
-
-### Server Components Role:
-
-Server Components should handle:
-- Layout and static content
-- SEO metadata
-- Passing static props to Client Components
-
-**NOT** data fetching that goes through the API layer.
diff --git a/.agents/skills/react-best-practices/rules/client-react-compiler-optimal.md b/.agents/skills/react-best-practices/rules/client-react-compiler-optimal.md
deleted file mode 100644
index f05e627..0000000
--- a/.agents/skills/react-best-practices/rules/client-react-compiler-optimal.md
+++ /dev/null
@@ -1,116 +0,0 @@
----
-title: Use useMemo/useCallback Only When React Compiler is Disabled
-impact: LOW
-impactDescription: React Compiler handles most memoization automatically
-tags: client, react-compiler, performance, memoization
----
-
-## Use useMemo/useCallback Only When React Compiler is Disabled
-
-**IMPORTANT:** React Compiler (enabled in this project) automatically handles memoization for `useMemo`, `useCallback`, `React.memo`. You only need these hooks when React Compiler is disabled.
-
-### React Compiler vs Manual Memoization
-
-| Feature | React Compiler (Enabled) | Manual Memoization |
-|----------|----------------------|-------------------|
-| Function memoization | Automatic | Redundant |
-| Prop memoization | Automatic | Redundant |
-| Dependency analysis | Automatic | Redundant |
-| Bailout optimization | Automatic | Redundant |
-
-### When to Still Use useMemo/useCallback
-
-Even with React Compiler enabled, there are **rare cases** where manual memoization might help:
-
-#### 1. Expensive Computations NOT in Render Path
-
-```tsx
-// Correct: Memoize expensive computation
-function ExpensiveChart({ data }: { data: DataPoint[] }) {
-  const processedData = useMemo(() => {
-    return data.map(point => ({
-      x: point.x * 1000, // Expensive transform
-      y: Math.log(point.y) // Expensive calculation
-    }))
-  }, [data])
-
-  return <Chart data={processedData} />
-}
-```
-
-```tsx
-// Incorrect: Memoize cheap props (redundant with React Compiler)
-function SimpleChart({ data }: { data: DataPoint[] }) {
-  const processedData = useMemo(() => {
-    return data.map(point => point) // Too simple, not worth memoizing
-  }, [data])
-
-  return <Chart data={processedData} />
-}
-```
-
-#### 2. Memoizing Values Used Across Renders
-
-```tsx
-// Correct: Memoize value reused in multiple renders
-function Dashboard() {
-  const { data } = useHeavyData() // Expensive computation
-
-  return (
-    <>
-      <Card title="Summary">
-        <SummaryWidget value={data} />
-      </Card>
-      <Card title="Details">
-        <DetailsWidget value={data} />
-      </Card>
-    </>
-  )
-}
-```
-
-#### 3. Referential Stability for Custom Hooks
-
-```tsx
-// Correct: Use useMemo for derived state
-function useDerivedState(base: number) {
-  const doubled = useMemo(() => base * 2, [base])
-  const squared = useMemo(() => base * base, [base])
-
-  return { doubled, squared }
-}
-```
-
-### Anti-Patterns (AVOID with React Compiler)
-
-```tsx
-// DON'T: Wrap simple callbacks in useCallback
-function Button({ onClick }: { onClick: () => void }) {
-  const handleClick = useCallback(() => onClick(), []) // Redundant
-  return <button onClick={handleClick}>Click</button>
-}
-```
-
-```tsx
-// DON'T: Memoize render-return values
-function Component({ props }: Props) {
-  const memoizedProps = useMemo(() => props, [props]) // Useless
-  return <div>{memoizedProps.text}</div>
-}
-```
-
-### React Compiler Project Note
-
-This project has React Compiler enabled (`reactCompiler: true` in next.config.ts). The compiler automatically:
-- Optimizes `useMemo` and `useCallback` dependencies
-- Inlines memoized values
-- Eliminates unnecessary re-renders
-
-**Bottom line:** Trust React Compiler first. Only add manual memoization when:
-1. You profile a performance bottleneck
-2. The computation is genuinely expensive
-3. React Compiler optimization is not sufficient for your use case
-
-### For Projects Without React Compiler
-
-If React Compiler is disabled (removed from config or disabled flag), refer to `client-tanstack-query-dedup` for general data fetching optimization.
diff --git a/.agents/skills/react-best-practices/rules/client-tanstack-query-dedup.md b/.agents/skills/react-best-practices/rules/client-tanstack-query-dedup.md
deleted file mode 100644
index fb8b81b..0000000
--- a/.agents/skills/react-best-practices/rules/client-tanstack-query-dedup.md
+++ /dev/null
@@ -1,70 +0,0 @@
----
-title: Use @tanstack/query for Automatic Deduplication
-impact: MEDIUM-HIGH
-impactDescription: automatic deduplication
-tags: client, tanstack-query, react-query, deduplication, data-fetching
----
-
-## Use @tanstack/query for Automatic Deduplication
-
-@tanstack/query (React Query) enables request deduplication, caching, and revalidation across component instances.
-
-**Incorrect (no deduplication, each instance fetches):**
-
-```tsx
-function UserList() {
-  const [users, setUsers] = useState([])
-  useEffect(() => {
-    fetch('/api/users')
-      .then(r => r.json())
-      .then(setUsers)
-  }, [])
-}
-```
-
-**Correct (multiple instances share one request):**
-
-```tsx
-import { useQuery } from '@tanstack/react-query'
-
-function UserList() {
-  const { data: users } = useQuery({
-    queryKey: ['users'],
-    queryFn: () => fetch('/api/users').then(r => r.json())
-  })
-}
-```
-
-**For immutable/static data:**
-
-```tsx
-import { useQuery } from '@tanstack/react-query'
-
-function StaticContent() {
-  const { data } = useQuery({
-    queryKey: ['config'],
-    queryFn: fetchConfig,
-    staleTime: Infinity,
-    gcTime: Infinity
-  })
-}
-```
-
-**For mutations:**
-
-```tsx
-import { useMutation, useQueryClient } from '@tanstack/react-query'
-
-function UpdateButton() {
-  const queryClient = useQueryClient()
-  const { mutate } = useMutation({
-    mutationFn: updateUser,
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ['user'] })
-    }
-  })
-  return <button onClick={() => mutate()}>Update</button>
-}
-```
-
-Reference: [https://tanstack.com/query](https://tanstack.com/query)
diff --git a/.agents/skills/react-best-practices/rules/js-batch-dom-css.md b/.agents/skills/react-best-practices/rules/js-batch-dom-css.md
deleted file mode 100644
index 92a3b63..0000000
--- a/.agents/skills/react-best-practices/rules/js-batch-dom-css.md
+++ /dev/null
@@ -1,82 +0,0 @@
----
-title: Batch DOM CSS Changes
-impact: MEDIUM
-impactDescription: reduces reflows/repaints
-tags: javascript, dom, css, performance, reflow
----
-
-## Batch DOM CSS Changes
-
-Avoid changing styles one property at a time. Group multiple CSS changes together via classes or `cssText` to minimize browser reflows.
-
-**Incorrect (multiple reflows):**
-
-```typescript
-function updateElementStyles(element: HTMLElement) {
-  // Each line triggers a reflow
-  element.style.width = '100px'
-  element.style.height = '200px'
-  element.style.backgroundColor = 'blue'
-  element.style.border = '1px solid black'
-}
-```
-
-**Correct (add class - single reflow):**
-
-```typescript
-// CSS file
-.highlighted-box {
-  width: 100px;
-  height: 200px;
-  background-color: blue;
-  border: 1px solid black;
-}
-
-// JavaScript
-function updateElementStyles(element: HTMLElement) {
-  element.classList.add('highlighted-box')
-}
-```
-
-**Correct (change cssText - single reflow):**
-
-```typescript
-function updateElementStyles(element: HTMLElement) {
-  element.style.cssText = `
-    width: 100px;
-    height: 200px;
-    background-color: blue;
-    border: 1px solid black;
-  `
-}
-```
-
-**React example:**
-
-```tsx
-// Incorrect: changing styles one by one
-function Box({ isHighlighted }: { isHighlighted: boolean }) {
-  const ref = useRef<HTMLDivElement>(null)
-  
-  useEffect(() => {
-    if (ref.current && isHighlighted) {
-      ref.current.style.width = '100px'
-      ref.current.style.height = '200px'
-      ref.current.style.backgroundColor = 'blue'
-    }
-  }, [isHighlighted])
-  
-  return <div ref={ref}>Content</div>
-}
-
-// Correct: toggle class
-function Box({ isHighlighted }: { isHighlighted: boolean }) {
-  return (
-    <div className={isHighlighted ? 'highlighted-box' : ''}>
-      Content
-    </div>
-  )
-}
-```
-
-Prefer CSS classes over inline styles when possible. Classes are cached by the browser and provide better separation of concerns.
diff --git a/.agents/skills/react-best-practices/rules/js-cache-function-results.md b/.agents/skills/react-best-practices/rules/js-cache-function-results.md
deleted file mode 100644
index 180f8ac..0000000
--- a/.agents/skills/react-best-practices/rules/js-cache-function-results.md
+++ /dev/null
@@ -1,80 +0,0 @@
----
-title: Cache Repeated Function Calls
-impact: MEDIUM
-impactDescription: avoid redundant computation
-tags: javascript, cache, memoization, performance
----
-
-## Cache Repeated Function Calls
-
-Use a module-level Map to cache function results when the same function is called repeatedly with the same inputs during render.
-
-**Incorrect (redundant computation):**
-
-```typescript
-function ProjectList({ projects }: { projects: Project[] }) {
-  return (
-    <div>
-      {projects.map(project => {
-        // slugify() called 100+ times for same project names
-        const slug = slugify(project.name)
-        
-        return <ProjectCard key={project.id} slug={slug} />
-      })}
-    </div>
-  )
-}
-```
-
-**Correct (cached results):**
-
-```typescript
-// Module-level cache
-const slugifyCache = new Map<string, string>()
-
-function cachedSlugify(text: string): string {
-  if (slugifyCache.has(text)) {
-    return slugifyCache.get(text)!
-  }
-  const result = slugify(text)
-  slugifyCache.set(text, result)
-  return result
-}
-
-function ProjectList({ projects }: { projects: Project[] }) {
-  return (
-    <div>
-      {projects.map(project => {
-        // Computed only once per unique project name
-        const slug = cachedSlugify(project.name)
-        
-        return <ProjectCard key={project.id} slug={slug} />
-      })}
-    </div>
-  )
-}
-```
-
-**Simpler pattern for single-value functions:**
-
-```typescript
-let isLoggedInCache: boolean | null = null
-
-function isLoggedIn(): boolean {
-  if (isLoggedInCache !== null) {
-    return isLoggedInCache
-  }
-  
-  isLoggedInCache = document.cookie.includes('auth=')
-  return isLoggedInCache
-}
-
-// Clear cache when auth changes
-function onAuthChange() {
-  isLoggedInCache = null
-}
-```
-
-Use a Map (not a hook) so it works everywhere: utilities, event handlers, not just React components.
-
-Reference: [How we made the Vercel Dashboard twice as fast](https://vercel.com/blog/how-we-made-the-vercel-dashboard-twice-as-fast)
diff --git a/.agents/skills/react-best-practices/rules/js-cache-property-access.md b/.agents/skills/react-best-practices/rules/js-cache-property-access.md
deleted file mode 100644
index 39eec90..0000000
--- a/.agents/skills/react-best-practices/rules/js-cache-property-access.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-title: Cache Property Access in Loops
-impact: LOW-MEDIUM
-impactDescription: reduces lookups
-tags: javascript, loops, optimization, caching
----
-
-## Cache Property Access in Loops
-
-Cache object property lookups in hot paths.
-
-**Incorrect (3 lookups × N iterations):**
-
-```typescript
-for (let i = 0; i < arr.length; i++) {
-  process(obj.config.settings.value)
-}
-```
-
-**Correct (1 lookup total):**
-
-```typescript
-const value = obj.config.settings.value
-const len = arr.length
-for (let i = 0; i < len; i++) {
-  process(value)
-}
-```
diff --git a/.agents/skills/react-best-practices/rules/js-cache-storage.md b/.agents/skills/react-best-practices/rules/js-cache-storage.md
deleted file mode 100644
index 1716c87..0000000
--- a/.agents/skills/react-best-practices/rules/js-cache-storage.md
+++ /dev/null
@@ -1,111 +0,0 @@
----
-title: Cache Storage API Calls
-impact: LOW-MEDIUM
-impactDescription: reduces expensive I/O
-tags: javascript, localStorage, storage, caching, performance
----
-
-## Cache Storage API Calls
-
-`localStorage`, `sessionStorage`, and `document.cookie` are synchronous and expensive. Cache reads in memory.
-
-**Recommended for React components: use `@reactuses/core`:**
-
-```tsx
-import { useLocalStorage, useSessionStorage } from "@reactuses/core";
-
-function ThemeToggle() {
-  // Automatically handles caching and cross-tab synchronization
-  const [theme, setTheme] = useLocalStorage("theme", "light");
-
-  return (
-    <button onClick={() => setTheme(theme === "light" ? "dark" : "light")}>
-      Current: {theme}
-    </button>
-  );
-}
-
-function SessionManager() {
-  // Data persists only for the browser session
-  const [sessionData, setSessionData] = useSessionStorage("user-session", null);
-
-  return (
-    <div>
-      <p>Session: {sessionData ? JSON.stringify(sessionData) : "None"}</p>
-      <button onClick={() => setSessionData({ id: 1 })}>Set</button>
-      <button onClick={() => setSessionData(null)}>Clear</button>
-    </div>
-  );
-}
-```
-
-`useLocalStorage` and `useSessionStorage` from `@reactuses/core` handle:
-- In-memory caching to avoid repeated storage reads
-- Cross-tab synchronization via storage events
-- Type-safe serialization/deserialization
-
----
-
-**Manual approach for non-React code:**
-
-For utilities and event handlers outside React components, use a Map cache:
-
-**Incorrect (reads storage on every call):**
-
-```typescript
-function getTheme() {
-  return localStorage.getItem("theme") ?? "light";
-}
-// Called 10 times = 10 storage reads
-```
-
-**Correct (Map cache):**
-
-```typescript
-const storageCache = new Map<string, string | null>();
-
-function getLocalStorage(key: string) {
-  if (!storageCache.has(key)) {
-    storageCache.set(key, localStorage.getItem(key));
-  }
-  return storageCache.get(key);
-}
-
-function setLocalStorage(key: string, value: string) {
-  localStorage.setItem(key, value);
-  storageCache.set(key, value); // keep cache in sync
-}
-```
-
-Use a Map (not a hook) so it works everywhere: utilities, event handlers, not just React components.
-
-**Cookie caching:**
-
-```typescript
-let cookieCache: Record<string, string> | null = null;
-
-function getCookie(name: string) {
-  if (!cookieCache) {
-    cookieCache = Object.fromEntries(
-      document.cookie.split("; ").map((c) => c.split("="))
-    );
-  }
-  return cookieCache[name];
-}
-```
-
-**Important (invalidate on external changes):**
-
-If storage can change externally (another tab, server-set cookies), invalidate cache:
-
-```typescript
-window.addEventListener("storage", (e) => {
-  if (e.key) storageCache.delete(e.key);
-});
-
-document.addEventListener("visibilitychange", () => {
-  if (document.visibilityState === "visible") {
-    storageCache.clear();
-  }
-});
-```
diff --git a/.agents/skills/react-best-practices/rules/js-combine-iterations.md b/.agents/skills/react-best-practices/rules/js-combine-iterations.md
deleted file mode 100644
index 044d017..0000000
--- a/.agents/skills/react-best-practices/rules/js-combine-iterations.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-title: Combine Multiple Array Iterations
-impact: LOW-MEDIUM
-impactDescription: reduces iterations
-tags: javascript, arrays, loops, performance
----
-
-## Combine Multiple Array Iterations
-
-Multiple `.filter()` or `.map()` calls iterate the array multiple times. Combine into one loop.
-
-**Incorrect (3 iterations):**
-
-```typescript
-const admins = users.filter(u => u.isAdmin)
-const testers = users.filter(u => u.isTester)
-const inactive = users.filter(u => !u.isActive)
-```
-
-**Correct (1 iteration):**
-
-```typescript
-const admins: User[] = []
-const testers: User[] = []
-const inactive: User[] = []
-
-for (const user of users) {
-  if (user.isAdmin) admins.push(user)
-  if (user.isTester) testers.push(user)
-  if (!user.isActive) inactive.push(user)
-}
-```
diff --git a/.agents/skills/react-best-practices/rules/js-early-exit.md b/.agents/skills/react-best-practices/rules/js-early-exit.md
deleted file mode 100644
index f46cb89..0000000
--- a/.agents/skills/react-best-practices/rules/js-early-exit.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-title: Early Return from Functions
-impact: LOW-MEDIUM
-impactDescription: avoids unnecessary computation
-tags: javascript, functions, optimization, early-return
----
-
-## Early Return from Functions
-
-Return early when result is determined to skip unnecessary processing.
-
-**Incorrect (processes all items even after finding answer):**
-
-```typescript
-function validateUsers(users: User[]) {
-  let hasError = false
-  let errorMessage = ''
-  
-  for (const user of users) {
-    if (!user.email) {
-      hasError = true
-      errorMessage = 'Email required'
-    }
-    if (!user.name) {
-      hasError = true
-      errorMessage = 'Name required'
-    }
-    // Continues checking all users even after error found
-  }
-  
-  return hasError ? { valid: false, error: errorMessage } : { valid: true }
-}
-```
-
-**Correct (returns immediately on first error):**
-
-```typescript
-function validateUsers(users: User[]) {
-  for (const user of users) {
-    if (!user.email) {
-      return { valid: false, error: 'Email required' }
-    }
-    if (!user.name) {
-      return { valid: false, error: 'Name required' }
-    }
-  }
-
-  return { valid: true }
-}
-```
diff --git a/.agents/skills/react-best-practices/rules/js-index-maps.md b/.agents/skills/react-best-practices/rules/js-index-maps.md
deleted file mode 100644
index 9d357a0..0000000
--- a/.agents/skills/react-best-practices/rules/js-index-maps.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-title: Build Index Maps for Repeated Lookups
-impact: LOW-MEDIUM
-impactDescription: 1M ops to 2K ops
-tags: javascript, map, indexing, optimization, performance
----
-
-## Build Index Maps for Repeated Lookups
-
-Multiple `.find()` calls by the same key should use a Map.
-
-**Incorrect (O(n) per lookup):**
-
-```typescript
-function processOrders(orders: Order[], users: User[]) {
-  return orders.map(order => ({
-    ...order,
-    user: users.find(u => u.id === order.userId)
-  }))
-}
-```
-
-**Correct (O(1) per lookup):**
-
-```typescript
-function processOrders(orders: Order[], users: User[]) {
-  const userById = new Map(users.map(u => [u.id, u]))
-
-  return orders.map(order => ({
-    ...order,
-    user: userById.get(order.userId)
-  }))
-}
-```
-
-Build map once (O(n)), then all lookups are O(1).
-For 1000 orders × 1000 users: 1M ops → 2K ops.
diff --git a/.agents/skills/react-best-practices/rules/js-length-check-first.md b/.agents/skills/react-best-practices/rules/js-length-check-first.md
deleted file mode 100644
index 6c38625..0000000
--- a/.agents/skills/react-best-practices/rules/js-length-check-first.md
+++ /dev/null
@@ -1,49 +0,0 @@
----
-title: Early Length Check for Array Comparisons
-impact: MEDIUM-HIGH
-impactDescription: avoids expensive operations when lengths differ
-tags: javascript, arrays, performance, optimization, comparison
----
-
-## Early Length Check for Array Comparisons
-
-When comparing arrays with expensive operations (sorting, deep equality, serialization), check lengths first. If lengths differ, the arrays cannot be equal.
-
-In real-world applications, this optimization is especially valuable when the comparison runs in hot paths (event handlers, render loops).
-
-**Incorrect (always runs expensive comparison):**
-
-```typescript
-function hasChanges(current: string[], original: string[]) {
-  // Always sorts and joins, even when lengths differ
-  return current.sort().join() !== original.sort().join()
-}
-```
-
-Two O(n log n) sorts run even when `current.length` is 5 and `original.length` is 100. There is also overhead of joining the arrays and comparing the strings.
-
-**Correct (O(1) length check first):**
-
-```typescript
-function hasChanges(current: string[], original: string[]) {
-  // Early return if lengths differ
-  if (current.length !== original.length) {
-    return true
-  }
-  // Only sort/join when lengths match
-  const currentSorted = current.toSorted()
-  const originalSorted = original.toSorted()
-  for (let i = 0; i < currentSorted.length; i++) {
-    if (currentSorted[i] !== originalSorted[i]) {
-      return true
-    }
-  }
-  return false
-}
-```
-
-This new approach is more efficient because:
-- It avoids the overhead of sorting and joining the arrays when lengths differ
-- It avoids consuming memory for the joined strings (especially important for large arrays)
-- It avoids mutating the original arrays
-- It returns early when a difference is found
diff --git a/.agents/skills/react-best-practices/rules/js-min-max-loop.md b/.agents/skills/react-best-practices/rules/js-min-max-loop.md
deleted file mode 100644
index 02caec5..0000000
--- a/.agents/skills/react-best-practices/rules/js-min-max-loop.md
+++ /dev/null
@@ -1,82 +0,0 @@
----
-title: Use Loop for Min/Max Instead of Sort
-impact: LOW
-impactDescription: O(n) instead of O(n log n)
-tags: javascript, arrays, performance, sorting, algorithms
----
-
-## Use Loop for Min/Max Instead of Sort
-
-Finding the smallest or largest element only requires a single pass through the array. Sorting is wasteful and slower.
-
-**Incorrect (O(n log n) - sort to find latest):**
-
-```typescript
-interface Project {
-  id: string
-  name: string
-  updatedAt: number
-}
-
-function getLatestProject(projects: Project[]) {
-  const sorted = [...projects].sort((a, b) => b.updatedAt - a.updatedAt)
-  return sorted[0]
-}
-```
-
-Sorts the entire array just to find the maximum value.
-
-**Incorrect (O(n log n) - sort for oldest and newest):**
-
-```typescript
-function getOldestAndNewest(projects: Project[]) {
-  const sorted = [...projects].sort((a, b) => a.updatedAt - b.updatedAt)
-  return { oldest: sorted[0], newest: sorted[sorted.length - 1] }
-}
-```
-
-Still sorts unnecessarily when only min/max are needed.
-
-**Correct (O(n) - single loop):**
-
-```typescript
-function getLatestProject(projects: Project[]) {
-  if (projects.length === 0) return null
-  
-  let latest = projects[0]
-  
-  for (let i = 1; i < projects.length; i++) {
-    if (projects[i].updatedAt > latest.updatedAt) {
-      latest = projects[i]
-    }
-  }
-  
-  return latest
-}
-
-function getOldestAndNewest(projects: Project[]) {
-  if (projects.length === 0) return { oldest: null, newest: null }
-  
-  let oldest = projects[0]
-  let newest = projects[0]
-  
-  for (let i = 1; i < projects.length; i++) {
-    if (projects[i].updatedAt < oldest.updatedAt) oldest = projects[i]
-    if (projects[i].updatedAt > newest.updatedAt) newest = projects[i]
-  }
-  
-  return { oldest, newest }
-}
-```
-
-Single pass through the array, no copying, no sorting.
-
-**Alternative (Math.min/Math.max for small arrays):**
-
-```typescript
-const numbers = [5, 2, 8, 1, 9]
-const min = Math.min(...numbers)
-const max = Math.max(...numbers)
-```
-
-This works for small arrays but can be slower for very large arrays due to spread operator limitations. Use the loop approach for reliability.
diff --git a/.agents/skills/react-best-practices/rules/js-set-map-lookups.md b/.agents/skills/react-best-practices/rules/js-set-map-lookups.md
deleted file mode 100644
index 680a489..0000000
--- a/.agents/skills/react-best-practices/rules/js-set-map-lookups.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-title: Use Set/Map for O(1) Lookups
-impact: LOW-MEDIUM
-impactDescription: O(n) to O(1)
-tags: javascript, set, map, data-structures, performance
----
-
-## Use Set/Map for O(1) Lookups
-
-Convert arrays to Set/Map for repeated membership checks.
-
-**Incorrect (O(n) per check):**
-
-```typescript
-const allowedIds = ['a', 'b', 'c', ...]
-items.filter(item => allowedIds.includes(item.id))
-```
-
-**Correct (O(1) per check):**
-
-```typescript
-const allowedIds = new Set(['a', 'b', 'c', ...])
-items.filter(item => allowedIds.has(item.id))
-```
diff --git a/.agents/skills/react-best-practices/rules/js-tosorted-immutable.md b/.agents/skills/react-best-practices/rules/js-tosorted-immutable.md
deleted file mode 100644
index eae8b3f..0000000
--- a/.agents/skills/react-best-practices/rules/js-tosorted-immutable.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-title: Use toSorted() Instead of sort() for Immutability
-impact: MEDIUM-HIGH
-impactDescription: prevents mutation bugs in React state
-tags: javascript, arrays, immutability, react, state, mutation
----
-
-## Use toSorted() Instead of sort() for Immutability
-
-`.sort()` mutates the array in place, which can cause bugs with React state and props. Use `.toSorted()` to create a new sorted array without mutation.
-
-**Incorrect (mutates original array):**
-
-```typescript
-function UserList({ users }: { users: User[] }) {
-  // Mutates the users prop array!
-  const sorted = useMemo(
-    () => users.sort((a, b) => a.name.localeCompare(b.name)),
-    [users]
-  )
-  return <div>{sorted.map(renderUser)}</div>
-}
-```
-
-**Correct (creates new array):**
-
-```typescript
-function UserList({ users }: { users: User[] }) {
-  // Creates new sorted array, original unchanged
-  const sorted = useMemo(
-    () => users.toSorted((a, b) => a.name.localeCompare(b.name)),
-    [users]
-  )
-  return <div>{sorted.map(renderUser)}</div>
-}
-```
-
-**Why this matters in React:**
-
-1. Props/state mutations break React's immutability model - React expects props and state to be treated as read-only
-2. Causes stale closure bugs - Mutating arrays inside closures (callbacks, effects) can lead to unexpected behavior
-
-**Browser support (fallback for older browsers):**
-
-`.toSorted()` is available in all modern browsers (Chrome 110+, Safari 16+, Firefox 115+, Node.js 20+). For older environments, use spread operator:
-
-```typescript
-// Fallback for older browsers
-const sorted = [...items].sort((a, b) => a.value - b.value)
-```
-
-**Other immutable array methods:**
-
-- `.toSorted()` - immutable sort
-- `.toReversed()` - immutable reverse
-- `.toSpliced()` - immutable splice
-- `.with()` - immutable element replacement
diff --git a/.agents/skills/react-best-practices/rules/rendering-activity.md b/.agents/skills/react-best-practices/rules/rendering-activity.md
deleted file mode 100644
index c957a49..0000000
--- a/.agents/skills/react-best-practices/rules/rendering-activity.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-title: Use Activity Component for Show/Hide
-impact: MEDIUM
-impactDescription: preserves state/DOM
-tags: rendering, activity, visibility, state-preservation
----
-
-## Use Activity Component for Show/Hide
-
-Use React's `<Activity>` to preserve state/DOM for expensive components that frequently toggle visibility.
-
-**Usage:**
-
-```tsx
-import { Activity } from 'react'
-
-function Dropdown({ isOpen }: Props) {
-  return (
-    <Activity mode={isOpen ? 'visible' : 'hidden'}>
-      <ExpensiveMenu />
-    </Activity>
-  )
-}
-```
-
-Avoids expensive re-renders and state loss.
diff --git a/.agents/skills/react-best-practices/rules/rendering-animate-svg-wrapper.md b/.agents/skills/react-best-practices/rules/rendering-animate-svg-wrapper.md
deleted file mode 100644
index 646744c..0000000
--- a/.agents/skills/react-best-practices/rules/rendering-animate-svg-wrapper.md
+++ /dev/null
@@ -1,47 +0,0 @@
----
-title: Animate SVG Wrapper Instead of SVG Element
-impact: LOW
-impactDescription: enables hardware acceleration
-tags: rendering, svg, css, animation, performance
----
-
-## Animate SVG Wrapper Instead of SVG Element
-
-Many browsers don't have hardware acceleration for CSS3 animations on SVG elements. Wrap SVG in a `<div>` and animate the wrapper instead.
-
-**Incorrect (animating SVG directly - no hardware acceleration):**
-
-```tsx
-function LoadingSpinner() {
-  return (
-    <svg 
-      className="animate-spin"
-      width="24" 
-      height="24" 
-      viewBox="0 0 24 24"
-    >
-      <circle cx="12" cy="12" r="10" stroke="currentColor" />
-    </svg>
-  )
-}
-```
-
-**Correct (animating wrapper div - hardware accelerated):**
-
-```tsx
-function LoadingSpinner() {
-  return (
-    <div className="animate-spin">
-      <svg 
-        width="24" 
-        height="24" 
-        viewBox="0 0 24 24"
-      >
-        <circle cx="12" cy="12" r="10" stroke="currentColor" />
-      </svg>
-    </div>
-  )
-}
-```
-
-This applies to all CSS transforms and transitions (`transform`, `opacity`, `translate`, `scale`, `rotate`). The wrapper div allows browsers to use GPU acceleration for smoother animations.
diff --git a/.agents/skills/react-best-practices/rules/rendering-content-visibility.md b/.agents/skills/react-best-practices/rules/rendering-content-visibility.md
deleted file mode 100644
index aa66563..0000000
--- a/.agents/skills/react-best-practices/rules/rendering-content-visibility.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-title: CSS content-visibility for Long Lists
-impact: HIGH
-impactDescription: faster initial render
-tags: rendering, css, content-visibility, long-lists
----
-
-## CSS content-visibility for Long Lists
-
-Apply `content-visibility: auto` to defer off-screen rendering.
-
-**CSS:**
-
-```css
-.message-item {
-  content-visibility: auto;
-  contain-intrinsic-size: 0 80px;
-}
-```
-
-**Example:**
-
-```tsx
-function MessageList({ messages }: { messages: Message[] }) {
-  return (
-    <div className="overflow-y-auto h-screen">
-      {messages.map(msg => (
-        <div key={msg.id} className="message-item">
-          <Avatar user={msg.author} />
-          <div>{msg.content}</div>
-        </div>
-      ))}
-    </div>
-  )
-}
-```
-
-For 1000 messages, browser skips layout/paint for ~990 off-screen items (10× faster initial render).
diff --git a/.agents/skills/react-best-practices/rules/rendering-hoist-jsx.md b/.agents/skills/react-best-practices/rules/rendering-hoist-jsx.md
deleted file mode 100644
index 32d2f3f..0000000
--- a/.agents/skills/react-best-practices/rules/rendering-hoist-jsx.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-title: Hoist Static JSX Elements
-impact: LOW
-impactDescription: avoids re-creation
-tags: rendering, jsx, static, optimization
----
-
-## Hoist Static JSX Elements
-
-Extract static JSX outside components to avoid re-creation.
-
-**Incorrect (recreates element every render):**
-
-```tsx
-function LoadingSkeleton() {
-  return <div className="animate-pulse h-20 bg-gray-200" />
-}
-
-function Container() {
-  return (
-    <div>
-      {loading && <LoadingSkeleton />}
-    </div>
-  )
-}
-```
-
-**Correct (reuses same element):**
-
-```tsx
-const loadingSkeleton = (
-  <div className="animate-pulse h-20 bg-gray-200" />
-)
-
-function Container() {
-  return (
-    <div>
-      {loading && loadingSkeleton}
-    </div>
-  )
-}
-```
-
-This is especially helpful for large and static SVG nodes, which can be expensive to recreate on every render.
-
-**Note:** If your project has [React Compiler](https://react.dev/learn/react-compiler) enabled, the compiler automatically hoists static JSX elements and optimizes component re-renders, making manual hoisting unnecessary.
diff --git a/.agents/skills/react-best-practices/rules/rendering-hydration-no-flicker.md b/.agents/skills/react-best-practices/rules/rendering-hydration-no-flicker.md
deleted file mode 100644
index 5cf0e79..0000000
--- a/.agents/skills/react-best-practices/rules/rendering-hydration-no-flicker.md
+++ /dev/null
@@ -1,82 +0,0 @@
----
-title: Prevent Hydration Mismatch Without Flickering
-impact: MEDIUM
-impactDescription: avoids visual flicker and hydration errors
-tags: rendering, ssr, hydration, localStorage, flicker
----
-
-## Prevent Hydration Mismatch Without Flickering
-
-When rendering content that depends on client-side storage (localStorage, cookies), avoid both SSR breakage and post-hydration flickering by injecting a synchronous script that updates the DOM before React hydrates.
-
-**Incorrect (breaks SSR):**
-
-```tsx
-function ThemeWrapper({ children }: { children: ReactNode }) {
-  // localStorage is not available on server - throws error
-  const theme = localStorage.getItem('theme') || 'light'
-  
-  return (
-    <div className={theme}>
-      {children}
-    </div>
-  )
-}
-```
-
-Server-side rendering will fail because `localStorage` is undefined.
-
-**Incorrect (visual flickering):**
-
-```tsx
-function ThemeWrapper({ children }: { children: ReactNode }) {
-  const [theme, setTheme] = useState('light')
-  
-  useEffect(() => {
-    // Runs after hydration - causes visible flash
-    const stored = localStorage.getItem('theme')
-    if (stored) {
-      setTheme(stored)
-    }
-  }, [])
-  
-  return (
-    <div className={theme}>
-      {children}
-    </div>
-  )
-}
-```
-
-Component first renders with default value (`light`), then updates after hydration, causing a visible flash of incorrect content.
-
-**Correct (no flicker, no hydration mismatch):**
-
-```tsx
-function ThemeWrapper({ children }: { children: ReactNode }) {
-  return (
-    <>
-      <div id="theme-wrapper">
-        {children}
-      </div>
-      <script
-        dangerouslySetInnerHTML={{
-          __html: `
-            (function() {
-              try {
-                var theme = localStorage.getItem('theme') || 'light';
-                var el = document.getElementById('theme-wrapper');
-                if (el) el.className = theme;
-              } catch (e) {}
-            })();
-          `,
-        }}
-      />
-    </>
-  )
-}
-```
-
-The inline script executes synchronously before showing the element, ensuring the DOM already has the correct value. No flickering, no hydration mismatch.
-
-This pattern is especially useful for theme toggles, user preferences, authentication states, and any client-only data that should render immediately without flashing default values.
diff --git a/.agents/skills/react-best-practices/rules/rendering-svg-precision.md b/.agents/skills/react-best-practices/rules/rendering-svg-precision.md
deleted file mode 100644
index 6d77128..0000000
--- a/.agents/skills/react-best-practices/rules/rendering-svg-precision.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-title: Optimize SVG Precision
-impact: LOW
-impactDescription: reduces file size
-tags: rendering, svg, optimization, svgo
----
-
-## Optimize SVG Precision
-
-Reduce SVG coordinate precision to decrease file size. The optimal precision depends on the viewBox size, but in general reducing precision should be considered.
-
-**Incorrect (excessive precision):**
-
-```svg
-<path d="M 10.293847 20.847362 L 30.938472 40.192837" />
-```
-
-**Correct (1 decimal place):**
-
-```svg
-<path d="M 10.3 20.8 L 30.9 40.2" />
-```
-
-**Automate with SVGO:**
-
-```bash
-npx svgo --precision=1 --multipass icon.svg
-```
diff --git a/.agents/skills/react-best-practices/rules/rerender-defer-reads.md b/.agents/skills/react-best-practices/rules/rerender-defer-reads.md
deleted file mode 100644
index e867c95..0000000
--- a/.agents/skills/react-best-practices/rules/rerender-defer-reads.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-title: Defer State Reads to Usage Point
-impact: MEDIUM
-impactDescription: avoids unnecessary subscriptions
-tags: rerender, searchParams, localStorage, optimization
----
-
-## Defer State Reads to Usage Point
-
-Don't subscribe to dynamic state (searchParams, localStorage) if you only read it inside callbacks.
-
-**Incorrect (subscribes to all searchParams changes):**
-
-```tsx
-function ShareButton({ chatId }: { chatId: string }) {
-  const searchParams = useSearchParams()
-
-  const handleShare = () => {
-    const ref = searchParams.get('ref')
-    shareChat(chatId, { ref })
-  }
-
-  return <button onClick={handleShare}>Share</button>
-}
-```
-
-**Correct (reads on demand, no subscription):**
-
-```tsx
-function ShareButton({ chatId }: { chatId: string }) {
-  const handleShare = () => {
-    const params = new URLSearchParams(window.location.search)
-    const ref = params.get('ref')
-    shareChat(chatId, { ref })
-  }
-
-  return <button onClick={handleShare}>Share</button>
-}
-```
diff --git a/.agents/skills/react-best-practices/rules/rerender-dependencies.md b/.agents/skills/react-best-practices/rules/rerender-dependencies.md
deleted file mode 100644
index 47a4d92..0000000
--- a/.agents/skills/react-best-practices/rules/rerender-dependencies.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-title: Narrow Effect Dependencies
-impact: LOW
-impactDescription: minimizes effect re-runs
-tags: rerender, useEffect, dependencies, optimization
----
-
-## Narrow Effect Dependencies
-
-Specify primitive dependencies instead of objects to minimize effect re-runs.
-
-**Incorrect (re-runs on any user field change):**
-
-```tsx
-useEffect(() => {
-  console.log(user.id)
-}, [user])
-```
-
-**Correct (re-runs only when id changes):**
-
-```tsx
-useEffect(() => {
-  console.log(user.id)
-}, [user.id])
-```
-
-**For derived state, compute outside effect:**
-
-```tsx
-// Incorrect: runs on width=767, 766, 765...
-useEffect(() => {
-  if (width < 768) {
-    enableMobileMode()
-  }
-}, [width])
-
-// Correct: runs only on boolean transition
-const isMobile = width < 768
-useEffect(() => {
-  if (isMobile) {
-    enableMobileMode()
-  }
-}, [isMobile])
-```
diff --git a/.agents/skills/react-best-practices/rules/rerender-derived-state.md b/.agents/skills/react-best-practices/rules/rerender-derived-state.md
deleted file mode 100644
index a15177c..0000000
--- a/.agents/skills/react-best-practices/rules/rerender-derived-state.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-title: Subscribe to Derived State
-impact: MEDIUM
-impactDescription: reduces re-render frequency
-tags: rerender, derived-state, media-query, optimization
----
-
-## Subscribe to Derived State
-
-Subscribe to derived boolean state instead of continuous values to reduce re-render frequency.
-
-**Incorrect (re-renders on every pixel change):**
-
-```tsx
-function Sidebar() {
-  const width = useWindowWidth()  // updates continuously
-  const isMobile = width < 768
-  return <nav className={isMobile ? 'mobile' : 'desktop'}>
-}
-```
-
-**Correct (re-renders only when boolean changes):**
-
-```tsx
-function Sidebar() {
-  const isMobile = useMediaQuery('(max-width: 767px)')
-  return <nav className={isMobile ? 'mobile' : 'desktop'}>
-}
-```
diff --git a/.agents/skills/react-best-practices/rules/rerender-functional-setstate.md b/.agents/skills/react-best-practices/rules/rerender-functional-setstate.md
deleted file mode 100644
index b004ef4..0000000
--- a/.agents/skills/react-best-practices/rules/rerender-functional-setstate.md
+++ /dev/null
@@ -1,74 +0,0 @@
----
-title: Use Functional setState Updates
-impact: MEDIUM
-impactDescription: prevents stale closures and unnecessary callback recreations
-tags: react, hooks, useState, useCallback, callbacks, closures
----
-
-## Use Functional setState Updates
-
-When updating state based on the current state value, use the functional update form of setState instead of directly referencing the state variable. This prevents stale closures, eliminates unnecessary dependencies, and creates stable callback references.
-
-**Incorrect (requires state as dependency):**
-
-```tsx
-function TodoList() {
-  const [items, setItems] = useState(initialItems)
-  
-  // Callback must depend on items, recreated on every items change
-  const addItems = useCallback((newItems: Item[]) => {
-    setItems([...items, ...newItems])
-  }, [items])  // ❌ items dependency causes recreations
-  
-  // Risk of stale closure if dependency is forgotten
-  const removeItem = useCallback((id: string) => {
-    setItems(items.filter(item => item.id !== id))
-  }, [])  // ❌ Missing items dependency - will use stale items!
-  
-  return <ItemsEditor items={items} onAdd={addItems} onRemove={removeItem} />
-}
-```
-
-The first callback is recreated every time `items` changes, which can cause child components to re-render unnecessarily. The second callback has a stale closure bug—it will always reference the initial `items` value.
-
-**Correct (stable callbacks, no stale closures):**
-
-```tsx
-function TodoList() {
-  const [items, setItems] = useState(initialItems)
-  
-  // Stable callback, never recreated
-  const addItems = useCallback((newItems: Item[]) => {
-    setItems(curr => [...curr, ...newItems])
-  }, [])  // ✅ No dependencies needed
-  
-  // Always uses latest state, no stale closure risk
-  const removeItem = useCallback((id: string) => {
-    setItems(curr => curr.filter(item => item.id !== id))
-  }, [])  // ✅ Safe and stable
-  
-  return <ItemsEditor items={items} onAdd={addItems} onRemove={removeItem} />
-}
-```
-
-**Benefits:**
-
-1. **Stable callback references** - Callbacks don't need to be recreated when state changes
-2. **No stale closures** - Always operates on the latest state value
-3. **Fewer dependencies** - Simplifies dependency arrays and reduces memory leaks
-4. **Prevents bugs** - Eliminates the most common source of React closure bugs
-
-**When to use functional updates:**
-
-- Any setState that depends on the current state value
-- Inside useCallback/useMemo when state is needed
-- Event handlers that reference state
-- Async operations that update state
-
-**When direct updates are fine:**
-
-- Setting state to a static value: `setCount(0)`
-- Setting state from props/arguments only: `setName(newName)`
-- State doesn't depend on previous value
-
-**Note:** If your project has [React Compiler](https://react.dev/learn/react-compiler) enabled, the compiler can automatically optimize some cases, but functional updates are still recommended for correctness and to prevent stale closure bugs.
diff --git a/.agents/skills/react-best-practices/rules/rerender-lazy-state-init.md b/.agents/skills/react-best-practices/rules/rerender-lazy-state-init.md
deleted file mode 100644
index 4ecb350..0000000
--- a/.agents/skills/react-best-practices/rules/rerender-lazy-state-init.md
+++ /dev/null
@@ -1,58 +0,0 @@
----
-title: Use Lazy State Initialization
-impact: MEDIUM
-impactDescription: wasted computation on every render
-tags: react, hooks, useState, performance, initialization
----
-
-## Use Lazy State Initialization
-
-Pass a function to `useState` for expensive initial values. Without the function form, the initializer runs on every render even though the value is only used once.
-
-**Incorrect (runs on every render):**
-
-```tsx
-function FilteredList({ items }: { items: Item[] }) {
-  // buildSearchIndex() runs on EVERY render, even after initialization
-  const [searchIndex, setSearchIndex] = useState(buildSearchIndex(items))
-  const [query, setQuery] = useState('')
-  
-  // When query changes, buildSearchIndex runs again unnecessarily
-  return <SearchResults index={searchIndex} query={query} />
-}
-
-function UserProfile() {
-  // JSON.parse runs on every render
-  const [settings, setSettings] = useState(
-    JSON.parse(localStorage.getItem('settings') || '{}')
-  )
-  
-  return <SettingsForm settings={settings} onChange={setSettings} />
-}
-```
-
-**Correct (runs only once):**
-
-```tsx
-function FilteredList({ items }: { items: Item[] }) {
-  // buildSearchIndex() runs ONLY on initial render
-  const [searchIndex, setSearchIndex] = useState(() => buildSearchIndex(items))
-  const [query, setQuery] = useState('')
-  
-  return <SearchResults index={searchIndex} query={query} />
-}
-
-function UserProfile() {
-  // JSON.parse runs only on initial render
-  const [settings, setSettings] = useState(() => {
-    const stored = localStorage.getItem('settings')
-    return stored ? JSON.parse(stored) : {}
-  })
-  
-  return <SettingsForm settings={settings} onChange={setSettings} />
-}
-```
-
-Use lazy initialization when computing initial values from localStorage/sessionStorage, building data structures (indexes, maps), reading from the DOM, or performing heavy transformations.
-
-For simple primitives (`useState(0)`), direct references (`useState(props.value)`), or cheap literals (`useState({})`), the function form is unnecessary.
diff --git a/.agents/skills/react-best-practices/rules/rerender-memo.md b/.agents/skills/react-best-practices/rules/rerender-memo.md
deleted file mode 100644
index f8982ab..0000000
--- a/.agents/skills/react-best-practices/rules/rerender-memo.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-title: Extract to Memoized Components
-impact: MEDIUM
-impactDescription: enables early returns
-tags: rerender, memo, useMemo, optimization
----
-
-## Extract to Memoized Components
-
-Extract expensive work into memoized components to enable early returns before computation.
-
-**Incorrect (computes avatar even when loading):**
-
-```tsx
-function Profile({ user, loading }: Props) {
-  const avatar = useMemo(() => {
-    const id = computeAvatarId(user)
-    return <Avatar id={id} />
-  }, [user])
-
-  if (loading) return <Skeleton />
-  return <div>{avatar}</div>
-}
-```
-
-**Correct (skips computation when loading):**
-
-```tsx
-const UserAvatar = memo(function UserAvatar({ user }: { user: User }) {
-  const id = useMemo(() => computeAvatarId(user), [user])
-  return <Avatar id={id} />
-})
-
-function Profile({ user, loading }: Props) {
-  if (loading) return <Skeleton />
-  return (
-    <div>
-      <UserAvatar user={user} />
-    </div>
-  )
-}
-```
-
-**Note:** If your project has [React Compiler](https://react.dev/learn/react-compiler) enabled, manual memoization with `memo()` and `useMemo()` is not necessary. The compiler automatically optimizes re-renders.
diff --git a/.agents/skills/react-best-practices/rules/rerender-transitions.md b/.agents/skills/react-best-practices/rules/rerender-transitions.md
deleted file mode 100644
index d99f43f..0000000
--- a/.agents/skills/react-best-practices/rules/rerender-transitions.md
+++ /dev/null
@@ -1,40 +0,0 @@
----
-title: Use Transitions for Non-Urgent Updates
-impact: MEDIUM
-impactDescription: maintains UI responsiveness
-tags: rerender, transitions, startTransition, performance
----
-
-## Use Transitions for Non-Urgent Updates
-
-Mark frequent, non-urgent state updates as transitions to maintain UI responsiveness.
-
-**Incorrect (blocks UI on every scroll):**
-
-```tsx
-function ScrollTracker() {
-  const [scrollY, setScrollY] = useState(0)
-  useEffect(() => {
-    const handler = () => setScrollY(window.scrollY)
-    window.addEventListener('scroll', handler, { passive: true })
-    return () => window.removeEventListener('scroll', handler)
-  }, [])
-}
-```
-
-**Correct (non-blocking updates):**
-
-```tsx
-import { startTransition } from 'react'
-
-function ScrollTracker() {
-  const [scrollY, setScrollY] = useState(0)
-  useEffect(() => {
-    const handler = () => {
-      startTransition(() => setScrollY(window.scrollY))
-    }
-    window.addEventListener('scroll', handler, { passive: true })
-    return () => window.removeEventListener('scroll', handler)
-  }, [])
-}
-```
diff --git a/.agents/skills/react-best-practices/rules/server-after-nonblocking.md b/.agents/skills/react-best-practices/rules/server-after-nonblocking.md
deleted file mode 100644
index e8f5b26..0000000
--- a/.agents/skills/react-best-practices/rules/server-after-nonblocking.md
+++ /dev/null
@@ -1,73 +0,0 @@
----
-title: Use after() for Non-Blocking Operations
-impact: MEDIUM
-impactDescription: faster response times
-tags: server, async, logging, analytics, side-effects
----
-
-## Use after() for Non-Blocking Operations
-
-Use Next.js's `after()` to schedule work that should execute after a response is sent. This prevents logging, analytics, and other side effects from blocking the response.
-
-**Incorrect (blocks response):**
-
-```tsx
-import { logUserAction } from '@/app/utils'
-
-export async function POST(request: Request) {
-  // Perform mutation
-  await updateDatabase(request)
-  
-  // Logging blocks the response
-  const userAgent = request.headers.get('user-agent') || 'unknown'
-  await logUserAction({ userAgent })
-  
-  return new Response(JSON.stringify({ status: 'success' }), {
-    status: 200,
-    headers: { 'Content-Type': 'application/json' }
-  })
-}
-```
-
-**Correct (non-blocking):**
-
-```tsx
-import { after } from 'next/server'
-import { headers, cookies } from 'next/headers'
-import { logUserAction } from '@/app/utils'
-
-export async function POST(request: Request) {
-  // Perform mutation
-  await updateDatabase(request)
-  
-  // Log after response is sent
-  after(async () => {
-    const userAgent = (await headers()).get('user-agent') || 'unknown'
-    const sessionCookie = (await cookies()).get('session-id')?.value || 'anonymous'
-    
-    logUserAction({ sessionCookie, userAgent })
-  })
-  
-  return new Response(JSON.stringify({ status: 'success' }), {
-    status: 200,
-    headers: { 'Content-Type': 'application/json' }
-  })
-}
-```
-
-The response is sent immediately while logging happens in the background.
-
-**Common use cases:**
-
-- Analytics tracking
-- Audit logging
-- Sending notifications
-- Cache invalidation
-- Cleanup tasks
-
-**Important notes:**
-
-- `after()` runs even if the response fails or redirects
-- Works in Server Actions, Route Handlers, and Server Components
-
-Reference: [https://nextjs.org/docs/app/api-reference/functions/after](https://nextjs.org/docs/app/api-reference/functions/after)
diff --git a/.agents/skills/workflow-guide/SKILL.md b/.agents/skills/workflow-guide/SKILL.md
new file mode 100644
index 0000000..bfaaec6
--- /dev/null
+++ b/.agents/skills/workflow-guide/SKILL.md
@@ -0,0 +1,67 @@
+---
+name: multi-agent-workflow
+description: Guide for coordinating PM, Frontend, Backend, Mobile, and QA agents on complex projects via CLI. Use for manual step-by-step coordination and workflow guidance.
+---
+
+# Multi-Agent Workflow Guide
+
+## When to use
+
+- Complex feature spanning multiple domains (full-stack, mobile)
+- Coordination needed between frontend, backend, mobile, and QA
+- User wants step-by-step guidance for multi-agent coordination
+
+## When NOT to use
+
+- Simple single-domain task -> use the specific agent directly
+- User wants automated execution -> use orchestrator
+- Quick bug fixes or minor changes
+
+## Core Rules
+
+1. Always start with PM Agent for task decomposition
+2. Spawn independent tasks in parallel (same priority tier)
+3. Define API contracts before frontend/mobile tasks
+4. QA review is always the final step
+5. Assign separate workspaces to avoid file conflicts
+6. Always use Serena MCP tools as the primary method for code exploration and modification
+7. Never skip steps in the workflow — follow each step sequentially without omission
+
+## Workflow
+
+### Step 1: Plan with PM Agent
+
+PM Agent analyzes requirements, selects tech stack, creates task breakdown with priorities.
+
+### Step 2: Spawn Agents by Priority
+
+Spawn agents via CLI:
+
+1. Use spawn-agent.sh for each task
+2. CLI selection follows agent_cli_mapping in user-preferences.yaml
+3. Spawn all same-priority tasks in parallel using background processes
+
+```bash
+# Example: spawn backend and frontend in parallel
+oh-my-ag agent:spawn backend "task description" session-id -w ./backend &
+oh-my-ag agent:spawn frontend "task description" session-id -w ./frontend &
+wait
+```
+
+### Step 3: Monitor & Coordinate
+
+- Use memory read tool to poll `progress-{agent}.md` files
+- Verify API contracts align between agents
+- Ensure shared data models are consistent
+
+### Step 4: QA Review
+
+Spawn QA Agent last to review all deliverables. Address CRITICAL issues by re-spawning agents.
+
+## Automated Alternative
+
+For fully automated execution without manual spawning, use the **orchestrator** skill instead.
+
+## References
+
+- Workflow examples: `resources/examples.md`
diff --git a/.agents/skills/workflow-guide/resources/examples.md b/.agents/skills/workflow-guide/resources/examples.md
new file mode 100644
index 0000000..3c34bb1
--- /dev/null
+++ b/.agents/skills/workflow-guide/resources/examples.md
@@ -0,0 +1,71 @@
+# Workflow Guide - Examples
+
+## Example 1: Full-Stack TODO App
+
+**Input**: "Build a TODO app with JWT authentication"
+
+**Workflow**:
+
+```
+Step 1: PM Agent plans the project
+  -> 5 tasks: auth API, CRUD API, login UI, todo UI, QA review
+
+Step 2: Spawn Priority 1 agents via CLI
+  # Run in parallel using background processes
+  oh-my-ag agent:spawn backend "JWT authentication API + TODO CRUD" session-id -w ./backend &
+  oh-my-ag agent:spawn frontend "Login/Register UI" session-id -w ./frontend &
+  wait
+
+Step 3: Monitor progress
+  - Use memory read tool to poll progress-{agent}.md files
+  - Verify API contracts align between backend/frontend
+
+Step 4: Spawn Priority 2 after P1 completes
+  .agents/skills/orchestrator/scripts/spawn-agent.sh frontend "TODO List UI" ./frontend
+
+Step 5: Spawn Priority 3
+  .agents/skills/orchestrator/scripts/spawn-agent.sh qa "Security + Performance review" .
+
+Step 6: Address QA findings
+  - Re-spawn agents for CRITICAL/HIGH issues
+  - Verify fixes
+```
+
+## Example 2: Adding Feature to Existing App
+
+**Input**: "Add a comment feature to the blog"
+
+**Workflow**:
+
+```
+Step 1: PM Agent analyzes existing codebase and plans
+  -> 2 tasks: Comments API, Comment Section UI
+
+Step 2: Spawn Backend Agent first (API-first)
+  oh-my-ag agent:spawn backend "Comments API with nested replies, pagination" session-id -w ./backend
+
+Step 3: After backend completes, spawn Frontend Agent
+  oh-my-ag agent:spawn frontend "Comment section UI using the new API endpoints" session-id -w ./frontend
+  (Sequential because frontend depends on API contracts)
+
+Step 4: QA review
+  oh-my-ag agent:spawn qa "Security: XSS in comments, rate limiting; Performance: Pagination, N+1 queries" session-id -w .
+```
+
+## Example 3: When to Use Orchestrator Instead
+
+**User**: "Run everything automatically"
+
+**Response**:
+
+```
+"You want fully automated execution. Let me switch to the
+orchestrator skill instead, which will:
+1. Spawn CLI subagents automatically
+2. Coordinate via Serena Memory
+3. Monitor progress and handle retries
+4. Return unified results
+
+Use workflow-guide when you want step-by-step control.
+Use orchestrator when you want hands-off automation."
+```
diff --git a/.claude/skills/backend-development b/.claude/skills/backend-development
deleted file mode 120000
index ee215e7..0000000
--- a/.claude/skills/backend-development
+++ /dev/null
@@ -1 +0,0 @@
-../../.agents/skills/backend-development
\ No newline at end of file
diff --git a/.claude/skills/devops-iac-engineer b/.claude/skills/devops-iac-engineer
deleted file mode 120000
index 61e4404..0000000
--- a/.claude/skills/devops-iac-engineer
+++ /dev/null
@@ -1 +0,0 @@
-../../.agents/skills/devops-iac-engineer
\ No newline at end of file
diff --git a/.claude/skills/frontend-engineer b/.claude/skills/frontend-engineer
deleted file mode 120000
index 442ab44..0000000
--- a/.claude/skills/frontend-engineer
+++ /dev/null
@@ -1 +0,0 @@
-../../.agents/skills/frontend-engineer
\ No newline at end of file
diff --git a/.claude/skills/react-best-practices b/.claude/skills/react-best-practices
deleted file mode 120000
index cf4af97..0000000
--- a/.claude/skills/react-best-practices
+++ /dev/null
@@ -1 +0,0 @@
-../../.agents/skills/react-best-practices
\ No newline at end of file
diff --git a/.github/skills/backend-development b/.github/skills/backend-development
deleted file mode 120000
index ee215e7..0000000
--- a/.github/skills/backend-development
+++ /dev/null
@@ -1 +0,0 @@
-../../.agents/skills/backend-development
\ No newline at end of file
diff --git a/.github/skills/devops-iac-engineer b/.github/skills/devops-iac-engineer
deleted file mode 120000
index 61e4404..0000000
--- a/.github/skills/devops-iac-engineer
+++ /dev/null
@@ -1 +0,0 @@
-../../.agents/skills/devops-iac-engineer
\ No newline at end of file
diff --git a/.github/skills/frontend-engineer b/.github/skills/frontend-engineer
deleted file mode 120000
index 442ab44..0000000
--- a/.github/skills/frontend-engineer
+++ /dev/null
@@ -1 +0,0 @@
-../../.agents/skills/frontend-engineer
\ No newline at end of file
diff --git a/.github/skills/react-best-practices b/.github/skills/react-best-practices
deleted file mode 120000
index cf4af97..0000000
--- a/.github/skills/react-best-practices
+++ /dev/null
@@ -1 +0,0 @@
-../../.agents/skills/react-best-practices
\ No newline at end of file