docs: reconcile documentation with reality (P3)

Make the project's documentation match the code and remove the sprawl. The docs
claimed Phase 2.8 (drug interactions) was 'planning/0%' and the backend '~91%
complete' — both wrong: 2.8 is implemented and live, plus the P0/P1 security
and test work is done. Five root CI/CD docs described a 'docker-build' CI job
that was removed; ~18 backend/ status snapshots and ~24 docs/implementation
duplicates cluttered the tree.

Deletions (85 files):
- Root: 4 stale CI/CD reports (CI-CD-{COMPLETION-REPORT,IMPLEMENTATION-SUMMARY,
  STATUS-REPORT,FINAL-STATUS}.md) — all describe the removed docker-build job.
- backend/: 18 phase/build/fix snapshots and code-dump .txt files.
- docs/: the 3 one-time reorg reports; ~17 docs/implementation duplicates and
  process artifacts; 4 stale docs/development CI docs + git snapshots;
  redundant deployment/testing files.
- thoughts/: STATUS.md (said Phase 2.4 in-progress), superseded phase notes and
  duplicative research inputs. tmp/ (928KB of CI debug logs, gitignored).

Moves (18 files):
- 9 genuine decision records -> docs/adr/ (Architecture Decision Records),
  date-prefixes stripped, with an index README.
- 8 historical-but-valuable phase plans/specs + the old CI-CD-FINAL-SOLUTION ->
  docs/archive/ (now-populated, with a README explaining it's superseded
  material). thoughts/ tree removed.

Rewrites (13 files) to match reality:
- Drop the fake '% complete' figures everywhere in favor of Implemented /
  In-Progress / Planned with concrete endpoint/feature lists.
- Phase 2.8 -> Implemented; add /api/interactions/* and /api/auth/{refresh,
  logout} to the endpoint lists; fix 'Rust 1.93' -> edition 2021.
- Add a Security section (token_version validation, hashed refresh-token
  persistence, fail-fast config, real-IP audit) and correct the test-coverage
  and deployment claims to reality.
- New canonical docs/development/CI-CD.md (4 jobs: format/clippy/build/test,
  mongo service, no docker-build + why).
- README, docs/README, product/{STATUS,ROADMAP,PROGRESS,README,introduction},
  implementation/README, development/README, testing/README, AI_AGENT_GUIDE,
  .cursorrules, .gooserules all updated.

Verified: greps for 'Phase 2.8 (Planning)', 'PLANNING (0%)', 'Rust 1.93',
'91%/10%/85% complete', and 'docker-build' return nothing outside docs/archive;
all internal doc links resolve; backend/src untouched (cargo build clean).

docs/archive/API_TEST_RESULTS_SOLARIA.md

@@ -0,0 +1,149 @@
+# Normogen Backend API Test Results - Solaria Deployment
+
+## Test Configuration
+- **Server:** http://solaria.solivarez.com.ar:8001
+- **Date:** March 5, 2026
+- **Status:** Phase 2.6 Complete - Security Hardening
+
+## Test Results Summary
+
+### ✅ System Health Checks
+| Test | Endpoint | Expected | Actual | Status |
+|------|----------|----------|--------|--------|
+| Health Check | GET /health | 200 | 200 | ✅ PASS |
+| Readiness Check | GET /ready | 200 | 200 | ✅ PASS |
+
+### ✅ Authentication Tests
+| Test | Endpoint | Expected | Actual | Status |
+|------|----------|----------|--------|--------|
+| Register New User | POST /api/auth/register | 201 | 201 | ✅ PASS |
+| Login (Valid) | POST /api/auth/login | 200 | 200 | ✅ PASS |
+| Login (Invalid) | POST /api/auth/login | 401 | 401 | ✅ PASS |
+| Login (Non-existent) | POST /api/auth/login | 401 | 401 | ✅ PASS |
+
+### ✅ Authorization Tests
+| Test | Endpoint | Expected | Actual | Status |
+|------|----------|----------|--------|--------|
+| Get Profile (No Auth) | GET /api/users/me | 401 | 401 | ✅ PASS |
+| Update Profile (No Auth) | PUT /api/users/me | 401 | 401 | ✅ PASS |
+| Change Password (No Auth) | POST /api/users/me/change-password | 401 | 401 | ✅ PASS |
+| Get Settings (No Auth) | GET /api/users/me/settings | 401 | 401 | ✅ PASS |
+
+### ✅ Share Management Tests
+| Test | Endpoint | Expected | Actual | Status |
+|------|----------|----------|--------|--------|
+| Create Share (No Auth) | POST /api/shares | 401 | 401 | ✅ PASS |
+| List Shares (No Auth) | GET /api/shares | 401 | 401 | ✅ PASS |
+
+### ✅ Session Management Tests
+| Test | Endpoint | Expected | Actual | Status |
+|------|----------|----------|--------|--------|
+| Get Sessions (No Auth) | GET /api/sessions | 401 | 401 | ✅ PASS |
+
+### ✅ Permission Tests
+| Test | Endpoint | Expected | Actual | Status |
+|------|----------|----------|--------|--------|
+| Check Permission (No Auth) | POST /api/permissions/check | 401 | 401 | ✅ PASS |
+
+### ✅ Error Handling Tests
+| Test | Endpoint | Expected | Actual | Status |
+|------|----------|----------|--------|--------|
+| Invalid Endpoint | GET /api/invalid | 404 | 404 | ✅ PASS |
+| Invalid JSON | POST /api/auth/login | 400 | 400 | ✅ PASS |
+
+## Overall Test Summary
+- **Total Tests:** 16
+- **Passed:** 16
+- **Failed:** 0
+- **Success Rate:** 100%
+
+## Phase 2.6 Security Features Verified
+
+### 1. Session Management ✅
+- Session endpoints are accessible and protected
+- Proper authentication required for session operations
+- Error handling working correctly
+
+### 2. Audit Logging ✅
+- Audit log service initialized and running
+- Ready to log security events
+- Database operations functioning
+
+### 3. Account Lockout ✅
+- Account lockout service active
+- Login attempts are tracked
+- Invalid credentials properly rejected
+
+### 4. Security Headers ✅
+- Security headers middleware applied to all routes
+- X-Content-Type-Options, X-Frame-Options, X-XSS-Protection active
+- CSP and HSTS headers configured
+
+### 5. Rate Limiting ⚠️ (Stub)
+- Rate limiting middleware in place
+- Currently passes through (to be implemented with governor)
+
+## API Endpoints Tested
+
+### Public Endpoints
+- `GET /health` - Health check (200)
+- `GET /ready` - Readiness check (200)
+- `POST /api/auth/register` - User registration (201)
+- `POST /api/auth/login` - User login (200/401)
+
+### Protected Endpoints (Require Authentication)
+All protected endpoints properly return 401 Unauthorized:
+- `GET /api/users/me` - Get user profile
+- `PUT /api/users/me` - Update profile
+- `POST /api/users/me/change-password` - Change password
+- `GET /api/users/me/settings` - Get settings
+- `POST /api/shares` - Create share
+- `GET /api/shares` - List shares
+- `GET /api/sessions` - Get sessions
+- `POST /api/permissions/check` - Check permissions
+
+## Next Steps
+
+### Phase 2.7: Health Data Features
+1. Implement lab results storage
+2. Add medication tracking
+3. Create health statistics endpoints
+4. Build appointment scheduling
+
+### Immediate Tasks
+1. Complete session integration with auth flow
+2. Add comprehensive audit logging to all handlers
+3. Implement proper rate limiting with governor crate
+4. Write integration tests for security features
+5. Add API documentation (OpenAPI/Swagger)
+
+### Performance Optimization
+1. Add database indexes for common queries
+2. Implement connection pooling optimization
+3. Add caching layer where appropriate
+4. Performance testing and profiling
+
+### Security Enhancements
+1. Add CORS configuration
+2. Implement API rate limiting per user
+3. Add request validation middleware
+4. Security audit and penetration testing
+
+## Deployment Status
+- ✅ Docker container running successfully
+- ✅ MongoDB connected and healthy
+- ✅ All services initialized
+- ✅ Port 8001 accessible
+- ✅ SSL/TLS ready (when needed)
+
+## Conclusion
+**Phase 2.6 is successfully deployed and all tests pass!** ✅
+
+The Normogen backend is now running on Solaria with robust security features:
+- Session management for device tracking
+- Audit logging for compliance
+- Account lockout for brute-force protection
+- Security headers for web protection
+- Proper authorization on all endpoints
+
+The backend is ready for Phase 2.7 development (Health Data Features).