docs: reconcile documentation with reality (P3)

Make the project's documentation match the code and remove the sprawl. The docs
claimed Phase 2.8 (drug interactions) was 'planning/0%' and the backend '~91%
complete' — both wrong: 2.8 is implemented and live, plus the P0/P1 security
and test work is done. Five root CI/CD docs described a 'docker-build' CI job
that was removed; ~18 backend/ status snapshots and ~24 docs/implementation
duplicates cluttered the tree.

Deletions (85 files):
- Root: 4 stale CI/CD reports (CI-CD-{COMPLETION-REPORT,IMPLEMENTATION-SUMMARY,
  STATUS-REPORT,FINAL-STATUS}.md) — all describe the removed docker-build job.
- backend/: 18 phase/build/fix snapshots and code-dump .txt files.
- docs/: the 3 one-time reorg reports; ~17 docs/implementation duplicates and
  process artifacts; 4 stale docs/development CI docs + git snapshots;
  redundant deployment/testing files.
- thoughts/: STATUS.md (said Phase 2.4 in-progress), superseded phase notes and
  duplicative research inputs. tmp/ (928KB of CI debug logs, gitignored).

Moves (18 files):
- 9 genuine decision records -> docs/adr/ (Architecture Decision Records),
  date-prefixes stripped, with an index README.
- 8 historical-but-valuable phase plans/specs + the old CI-CD-FINAL-SOLUTION ->
  docs/archive/ (now-populated, with a README explaining it's superseded
  material). thoughts/ tree removed.

Rewrites (13 files) to match reality:
- Drop the fake '% complete' figures everywhere in favor of Implemented /
  In-Progress / Planned with concrete endpoint/feature lists.
- Phase 2.8 -> Implemented; add /api/interactions/* and /api/auth/{refresh,
  logout} to the endpoint lists; fix 'Rust 1.93' -> edition 2021.
- Add a Security section (token_version validation, hashed refresh-token
  persistence, fail-fast config, real-IP audit) and correct the test-coverage
  and deployment claims to reality.
- New canonical docs/development/CI-CD.md (4 jobs: format/clippy/build/test,
  mongo service, no docker-build + why).
- README, docs/README, product/{STATUS,ROADMAP,PROGRESS,README,introduction},
  implementation/README, development/README, testing/README, AI_AGENT_GUIDE,
  .cursorrules, .gooserules all updated.

Verified: greps for 'Phase 2.8 (Planning)', 'PLANNING (0%)', 'Rust 1.93',
'91%/10%/85% complete', and 'docker-build' return nothing outside docs/archive;
all internal doc links resolve; backend/src untouched (cargo build clean).

docs/product/README.md

@@ -28,7 +28,7 @@ The backend API will be available at `http://localhost:8000`
 ### For Developers
 
 #### 1. Prerequisites
-- **Backend**: Rust 1.93+, Docker
+- **Backend**: Rust (edition 2021 toolchain), Docker
 - **Frontend**: Node.js 18+, npm
 
 #### 2. Backend Development
@@ -57,10 +57,10 @@ npm test                 # Run tests
 
 ## 📊 Current Status
 
-**Phase**: 2.8 - Drug Interactions & Advanced Features (Planning)  
-**Backend**: 91% complete  
-**Frontend**: 10% complete  
-**Deployment**: Docker on Solaria (production-ready)
+**Backend**: ✅ Phase 2.x feature-complete (through drug interactions); security-hardened; deployed on Solaria.
+**Frontend**: 🚧 Early (Login/Register + API/store layer; router not yet wired).
+**Deployment**: Docker on Solaria (image built manually — not in CI).
+**Tests**: 18 unit + 13 integration (auth + medication), CI-gated with MongoDB.
 
 See [STATUS.md](./STATUS.md) for detailed progress tracking.
 
@@ -76,7 +76,7 @@ This file - Product documentation overview and quick start.
 #### [STATUS.md](./STATUS.md)
 **Current project status and progress tracking**
 
-- Overall progress (Backend 91%, Frontend 10%)
+- Overall status (Backend feature-complete through Phase 2.8; Frontend early stage)
 - Phase-by-phase completion status
 - Recently completed features
 - Next milestones
@@ -135,14 +135,14 @@ This file - Product documentation overview and quick start.
 ### Project Overview
 - **Name**: Normogen (Balanced Life in Mapudungun)
 - **Goal**: Open-source health data platform for private, secure health data management
-- **Current Phase**: 2.8 - Drug Interactions & Advanced Features
-- **Backend**: Rust + Axum + MongoDB (91% complete)
-- **Frontend**: React + TypeScript + Material-UI (10% complete)
+- **Current Phase**: 2.8 (drug interactions) implemented; open work is the frontend (Phase 3)
+- **Backend**: Rust + Axum + MongoDB (Phase 2.x feature-complete, security-hardened)
+- **Frontend**: React + TypeScript + Material-UI (early stage — Login/Register + API/store layer)
 
 ### Technology Stack
 
 **Backend**:
-- Rust 1.93, Axum 0.7
+- Rust (edition 2021), Axum 0.7
 - MongoDB 7.0
 - JWT authentication (15min access, 30day refresh)
 - PBKDF2 password hashing (100K iterations)
@@ -284,19 +284,18 @@ cd web/normogen-web && npm test
 
 ## 📈 Project Progress
 
-### Backend: 91% Complete ✅
-- ✅ Authentication & authorization
+### Backend: Phase 2.x feature-complete ✅
+- ✅ Authentication & authorization (JWT, refresh-token rotation, token_version invalidation)
 - ✅ User management
 - ✅ Medication management
 - ✅ Health statistics
 - ✅ Lab results
-- ✅ Security features
-- 🚧 Drug interactions (Phase 2.8)
+- ✅ Security features (audit logging, account lockout, fail-fast config, real-IP audit)
+- ✅ Drug interactions (Phase 2.8)
 
-### Frontend: 10% Complete 🚧
-- 🚧 Basic React structure
-- 🚧 Login/register pages
-- 📋 Dashboard (planned)
+### Frontend: Early stage 🚧
+- 🚧 Login/register pages + API/store layer
+- 📋 Router wiring, dashboard (planned)
 - 📋 Medication UI (planned)
 
 See [STATUS.md](./STATUS.md) for detailed progress.
@@ -305,8 +304,7 @@ See [STATUS.md](./STATUS.md) for detailed progress.
 
 ## 🗺️ Roadmap
 
-### Phase 2.8 (Current - Planning)
-- Drug interaction checking
+### Phase 2.8 follow-ups (not started)
 - Automated reminders
 - Advanced analytics
 - Data export (FHIR, HL7)