docs: reconcile documentation with reality (P3)

Make the project's documentation match the code and remove the sprawl. The docs
claimed Phase 2.8 (drug interactions) was 'planning/0%' and the backend '~91%
complete' — both wrong: 2.8 is implemented and live, plus the P0/P1 security
and test work is done. Five root CI/CD docs described a 'docker-build' CI job
that was removed; ~18 backend/ status snapshots and ~24 docs/implementation
duplicates cluttered the tree.

Deletions (85 files):
- Root: 4 stale CI/CD reports (CI-CD-{COMPLETION-REPORT,IMPLEMENTATION-SUMMARY,
  STATUS-REPORT,FINAL-STATUS}.md) — all describe the removed docker-build job.
- backend/: 18 phase/build/fix snapshots and code-dump .txt files.
- docs/: the 3 one-time reorg reports; ~17 docs/implementation duplicates and
  process artifacts; 4 stale docs/development CI docs + git snapshots;
  redundant deployment/testing files.
- thoughts/: STATUS.md (said Phase 2.4 in-progress), superseded phase notes and
  duplicative research inputs. tmp/ (928KB of CI debug logs, gitignored).

Moves (18 files):
- 9 genuine decision records -> docs/adr/ (Architecture Decision Records),
  date-prefixes stripped, with an index README.
- 8 historical-but-valuable phase plans/specs + the old CI-CD-FINAL-SOLUTION ->
  docs/archive/ (now-populated, with a README explaining it's superseded
  material). thoughts/ tree removed.

Rewrites (13 files) to match reality:
- Drop the fake '% complete' figures everywhere in favor of Implemented /
  In-Progress / Planned with concrete endpoint/feature lists.
- Phase 2.8 -> Implemented; add /api/interactions/* and /api/auth/{refresh,
  logout} to the endpoint lists; fix 'Rust 1.93' -> edition 2021.
- Add a Security section (token_version validation, hashed refresh-token
  persistence, fail-fast config, real-IP audit) and correct the test-coverage
  and deployment claims to reality.
- New canonical docs/development/CI-CD.md (4 jobs: format/clippy/build/test,
  mongo service, no docker-build + why).
- README, docs/README, product/{STATUS,ROADMAP,PROGRESS,README,introduction},
  implementation/README, development/README, testing/README, AI_AGENT_GUIDE,
  .cursorrules, .gooserules all updated.

Verified: greps for 'Phase 2.8 (Planning)', 'PLANNING (0%)', 'Rust 1.93',
'91%/10%/85% complete', and 'docker-build' return nothing outside docs/archive;
all internal doc links resolve; backend/src untouched (cargo build clean).

docs/testing/API_TEST_RESULTS_SOLARIA.md

@@ -1,149 +0,0 @@
-# Normogen Backend API Test Results - Solaria Deployment
-
-## Test Configuration
-- **Server:** http://solaria.solivarez.com.ar:8001
-- **Date:** March 5, 2026
-- **Status:** Phase 2.6 Complete - Security Hardening
-
-## Test Results Summary
-
-### ✅ System Health Checks
-| Test | Endpoint | Expected | Actual | Status |
-|------|----------|----------|--------|--------|
-| Health Check | GET /health | 200 | 200 | ✅ PASS |
-| Readiness Check | GET /ready | 200 | 200 | ✅ PASS |
-
-### ✅ Authentication Tests
-| Test | Endpoint | Expected | Actual | Status |
-|------|----------|----------|--------|--------|
-| Register New User | POST /api/auth/register | 201 | 201 | ✅ PASS |
-| Login (Valid) | POST /api/auth/login | 200 | 200 | ✅ PASS |
-| Login (Invalid) | POST /api/auth/login | 401 | 401 | ✅ PASS |
-| Login (Non-existent) | POST /api/auth/login | 401 | 401 | ✅ PASS |
-
-### ✅ Authorization Tests
-| Test | Endpoint | Expected | Actual | Status |
-|------|----------|----------|--------|--------|
-| Get Profile (No Auth) | GET /api/users/me | 401 | 401 | ✅ PASS |
-| Update Profile (No Auth) | PUT /api/users/me | 401 | 401 | ✅ PASS |
-| Change Password (No Auth) | POST /api/users/me/change-password | 401 | 401 | ✅ PASS |
-| Get Settings (No Auth) | GET /api/users/me/settings | 401 | 401 | ✅ PASS |
-
-### ✅ Share Management Tests
-| Test | Endpoint | Expected | Actual | Status |
-|------|----------|----------|--------|--------|
-| Create Share (No Auth) | POST /api/shares | 401 | 401 | ✅ PASS |
-| List Shares (No Auth) | GET /api/shares | 401 | 401 | ✅ PASS |
-
-### ✅ Session Management Tests
-| Test | Endpoint | Expected | Actual | Status |
-|------|----------|----------|--------|--------|
-| Get Sessions (No Auth) | GET /api/sessions | 401 | 401 | ✅ PASS |
-
-### ✅ Permission Tests
-| Test | Endpoint | Expected | Actual | Status |
-|------|----------|----------|--------|--------|
-| Check Permission (No Auth) | POST /api/permissions/check | 401 | 401 | ✅ PASS |
-
-### ✅ Error Handling Tests
-| Test | Endpoint | Expected | Actual | Status |
-|------|----------|----------|--------|--------|
-| Invalid Endpoint | GET /api/invalid | 404 | 404 | ✅ PASS |
-| Invalid JSON | POST /api/auth/login | 400 | 400 | ✅ PASS |
-
-## Overall Test Summary
-- **Total Tests:** 16
-- **Passed:** 16
-- **Failed:** 0
-- **Success Rate:** 100%
-
-## Phase 2.6 Security Features Verified
-
-### 1. Session Management ✅
-- Session endpoints are accessible and protected
-- Proper authentication required for session operations
-- Error handling working correctly
-
-### 2. Audit Logging ✅
-- Audit log service initialized and running
-- Ready to log security events
-- Database operations functioning
-
-### 3. Account Lockout ✅
-- Account lockout service active
-- Login attempts are tracked
-- Invalid credentials properly rejected
-
-### 4. Security Headers ✅
-- Security headers middleware applied to all routes
-- X-Content-Type-Options, X-Frame-Options, X-XSS-Protection active
-- CSP and HSTS headers configured
-
-### 5. Rate Limiting ⚠️ (Stub)
-- Rate limiting middleware in place
-- Currently passes through (to be implemented with governor)
-
-## API Endpoints Tested
-
-### Public Endpoints
-- `GET /health` - Health check (200)
-- `GET /ready` - Readiness check (200)
-- `POST /api/auth/register` - User registration (201)
-- `POST /api/auth/login` - User login (200/401)
-
-### Protected Endpoints (Require Authentication)
-All protected endpoints properly return 401 Unauthorized:
-- `GET /api/users/me` - Get user profile
-- `PUT /api/users/me` - Update profile
-- `POST /api/users/me/change-password` - Change password
-- `GET /api/users/me/settings` - Get settings
-- `POST /api/shares` - Create share
-- `GET /api/shares` - List shares
-- `GET /api/sessions` - Get sessions
-- `POST /api/permissions/check` - Check permissions
-
-## Next Steps
-
-### Phase 2.7: Health Data Features
-1. Implement lab results storage
-2. Add medication tracking
-3. Create health statistics endpoints
-4. Build appointment scheduling
-
-### Immediate Tasks
-1. Complete session integration with auth flow
-2. Add comprehensive audit logging to all handlers
-3. Implement proper rate limiting with governor crate
-4. Write integration tests for security features
-5. Add API documentation (OpenAPI/Swagger)
-
-### Performance Optimization
-1. Add database indexes for common queries
-2. Implement connection pooling optimization
-3. Add caching layer where appropriate
-4. Performance testing and profiling
-
-### Security Enhancements
-1. Add CORS configuration
-2. Implement API rate limiting per user
-3. Add request validation middleware
-4. Security audit and penetration testing
-
-## Deployment Status
-- ✅ Docker container running successfully
-- ✅ MongoDB connected and healthy
-- ✅ All services initialized
-- ✅ Port 8001 accessible
-- ✅ SSL/TLS ready (when needed)
-
-## Conclusion
-**Phase 2.6 is successfully deployed and all tests pass!** ✅
-
-The Normogen backend is now running on Solaria with robust security features:
-- Session management for device tracking
-- Audit logging for compliance
-- Account lockout for brute-force protection
-- Security headers for web protection
-- Proper authorization on all endpoints
-
-The backend is ready for Phase 2.7 development (Health Data Features).

docs/testing/README.md

@@ -1,72 +1,48 @@
 # Testing Documentation
 
-This section contains test scripts, test results, and testing documentation.
+Test scripts, test notes, and the layout of the automated test suite.
 
-## 🧪 Test Scripts
+## Automated test suite (`backend/`)
+
+The authoritative tests live in the backend crate and run via `cargo test`:
+
+- **Unit tests** (`cargo test --lib`) — 18 tests in `src/`: client-IP resolution,
+  JWT round-trips, refresh-token hashing, token-version cache, services.
+- **Integration tests** (`cargo test --test auth_tests --test medication_tests`) —
+  13 tests in `tests/`, built in-process against an isolated per-run MongoDB
+  database via the shared `tests/common/mod.rs` helper. They **skip gracefully**
+  when MongoDB is unreachable, so `cargo test` stays green without a database.
+  Cover: register, login (right/wrong password), auth enforcement, refresh
+  rotation + reuse detection, logout, password-change invalidation, and
+  medication CRUD/auth flows.
+
+To run the integration tests for real, start a MongoDB first:
+
+```bash
+docker run -d -p 27017:27017 --name mongo-test mongo:7
+cd backend && cargo test --test auth_tests --test medication_tests
+```
+
+CI runs the full suite with a `mongo:7` service container — see
+[../development/CI-CD.md](../development/CI-CD.md).
+
+## Manual / smoke test scripts
 
-### API Testing
 - **[test-api-endpoints.sh](./test-api-endpoints.sh)** - Comprehensive API endpoint testing
 - **[test-medication-api.sh](./test-medication-api.sh)** - Medication-specific API tests
-- **[test-meds.sh](./test-meds.sh)** - Quick medication tests
-
-### Integration Testing
 - **[test-mvp-phase-2.7.sh](./test-mvp-phase-2.7.sh)** - Phase 2.7 MVP comprehensive tests
 - **[solaria-test.sh](./solaria-test.sh)** - Solaria deployment testing
 - **[check-solaria-logs.sh](./check-solaria-logs.sh)** - Log checking utility
+- **[quick-test.sh](./quick-test.sh)** - Fast smoke test
 
-### Quick Tests
-- **[quick-test.sh](./quick-test.sh)** - Fast smoke tests
+> Historical test-run snapshots are in [../archive/](../archive/README.md).
 
-## 📊 Test Results
+## Notes
 
-- **[API_TEST_RESULTS_SOLARIA.md](./API_TEST_RESULTS_SOLARIA.md)** - API test results from Solaria deployment
-
-## 🚀 Running Tests
-
-### Quick Smoke Test
-```bash
-./docs/testing/quick-test.sh
-```
-
-### Full API Test Suite
-```bash
-./docs/testing/test-api-endpoints.sh
-```
-
-### Medication API Tests
-```bash
-./docs/testing/test-medication-api.sh
-```
-
-### Phase 2.7 MVP Tests
-```bash
-./docs/testing/test-mvp-phase-2.7.sh
-```
-
-## 📋 Test Coverage
-
-### Backend Tests
-- ✅ Authentication (login, register, token refresh)
-- ✅ User management (profile, settings)
-- ✅ Permissions & shares
-- ✅ Medications (CRUD, logging, adherence)
-- ✅ Health statistics
-- ✅ Security (rate limiting, session management)
-- 🚧 Drug interactions (in progress)
-
-### Test Types
-- **Unit Tests**: Rust `cargo test`
-- **Integration Tests**: API endpoint tests
-- **E2E Tests**: Full workflow tests
-- **Deployment Tests**: Post-deployment verification
-
-## 📝 Test Notes
-
-- All tests require MongoDB to be running
-- Some tests require valid JWT tokens
-- Solaria tests require VPN/connection to Solaria server
-- Test data is isolated to prevent conflicts
+- Manual scripts that hit a live server need MongoDB running and (for protected
+  routes) a valid JWT.
+- Solaria tests require network access to the Solaria server.
 
 ---
 
-*Last Updated: 2026-03-09*
+*Last Updated: 2026-06-27*

docs/testing/test-meds.sh

@@ -1,6 +0,0 @@
-#!/bin/bash
-echo "Testing Medication API"
-curl -s http://solaria.solivarez.com.ar:8001/health
-echo ""
-echo "Registering user..."
-curl -s -X POST http://solaria.solivarez.com.ar:8001/api/auth/register -H "Content-Type: application/json" -d '{"email":"medtest@example.com","username":"medtest","password":"Password123!","first_name":"Test","last_name":"User"}'