chore(ci,docs): GitHub Actions, ADRs, README overhaul, §21 Hardening Release

- .github/workflows/ci.yml: two jobs — frontend (tsc --noEmit, lint, build,
  Playwright) and backend (Postgres 16 + odoo:19 --test-enable
  --test-tags encoach_api) — catches regressions before merge.
- docs/adr/: start an Architecture Decision Record trail with
  0001 canonical directory layout, 0002 JWT refresh flow,
  0003 paginated response envelope, 0004 RAG metadata + chunking.
- docs/PROJECT_SUMMARY.md §21 Hardening Release: full recap of the AI
  quality loop, compliance, Paymob, i18n, and CI work shipped in this
  drop, plus new DB tables, REST routes, frontend routes, verification
  results, and operator-facing configuration.
- README.md refreshed for the v4 split-repo doctrine and the new feature
  surface.
- new_project/DEPRECATED.md: formal retirement notice pointing at
  backend/ as the canonical tree.

Made-with: Cursor

docs/adr/0001-canonical-directory-layout.md

@@ -0,0 +1,52 @@
+# ADR 0001: Canonical `backend/` and `frontend/` directory layout
+
+- **Status:** Accepted
+- **Date:** 2026-04-08
+- **Deciders:** Platform team
+
+## Context
+
+The repository historically contained two overlapping copies of server code:
+
+- `backend/custom_addons/` — Odoo addons, actively developed.
+- `new_project/custom_addons/` — older snapshot, intermittently used for
+  one-off scripts and diverging subtly from `backend/`.
+
+Both paths showed up in `odoo.conf` variants, deploy scripts, and developer
+onboarding docs. Contributors routinely edited the wrong copy, shipped drift,
+or rediscovered that fixes "weren't taking" because they landed in the stale
+tree.
+
+The same ambiguity existed implicitly on the client side: several prototype
+apps lived under `new_project/frontend/` in addition to the main
+`frontend/` workspace.
+
+## Decision
+
+Declare a single canonical layout:
+
+- `backend/custom_addons/**` — the only Odoo addons tree. All deployments,
+  tests, and Docker images read from here.
+- `frontend/**` — the only React/Vite workspace.
+- `new_project/` — **deprecated**. A `DEPRECATED.md` is committed inside the
+  directory explaining the policy; no new files may be added.
+
+New `encoach_*` modules and frontend features MUST land under the canonical
+paths. Existing imports, Dockerfiles, and docs were updated accordingly.
+
+## Consequences
+
+- Positive: one obvious place to work, deterministic CI, no drift.
+- Positive: `PROJECT_SUMMARY.md` and this README become credible onboarding
+  material.
+- Negative: scripts that hard-coded `new_project/` paths had to be migrated
+  (one-time cost, done).
+
+## Alternatives considered
+
+- **Delete `new_project/` outright.** Rejected for now because a few historic
+  tarballs and experiment scripts still reference it; leaving the tree with a
+  `DEPRECATED.md` marker lets us retire it in a later cleanup pass without
+  blocking the hardening release.
+- **Rename `backend/` to `odoo/` to mirror Odoo's own layout.** Rejected
+  because `odoo/` is already used for the upstream Odoo source checkout.