docs(dev): align setup with current stack

docs/architecture/current.md

@@ -90,7 +90,7 @@ flowchart LR
 
 **Backend:** ASP.NET Core net9.0, EF Core 9 (SQLite default; Pomelo MySQL/MariaDB via `Database:Provider`), ASP.NET Identity Core, JWT bearer (smart policy scheme: local + Google), built-in RateLimiter, DataProtection (file-system keys), Playwright (PDF export).
 
-**Frontend:** **Next.js 16** + React 19 + **TypeScript 5.9** + MUI 7 (+ x-data-grid, x-date-pickers, lab), axios, react-router-dom 6, @tanstack/react-table, i18n EN + NB (custom provider), Jest/RTL.
+**Frontend:** **Next.js 16** + React 19 + **TypeScript 5.9** + MUI 7 (+ x-data-grid, x-date-pickers, lab), axios, react-router-dom 7, @tanstack/react-table, i18n EN + NB (custom provider), Jest/RTL.
 
 > Corrected 2026-07-31: the CRA migration is complete; direct Jest/Babel configuration replaced `react-scripts`.
 

docs/audits/audit-remediation-backlog.md

@@ -569,6 +569,8 @@ SEC-008 implements the same durable state machine with `<final>.uploading` and `
 
 ### P3-2 — Rebuild the current developer/operator documentation
 
+**Status (2026-08-30): repository scope complete.** The frontend/root/deployment/architecture sources now match Next.js 16, React Router 7, .NET 9, locked installs, current ports, and the implemented SQLite/MariaDB provider matrix. Clean install, lint, full frontend/backend tests, production build/TypeScript and locked NuGet restores pass; see `docs/verification/jt-018-developer-documentation.md` and V-193. A separate clean-machine/production operator rehearsal remains deployment evidence, not an undocumented implementation gap.
+
 - **Findings/scope:** JT-018 plus JT-016; frontend README, supported database matrix, architecture/API/env/setup/test/deploy source of truth.
 - **Dependencies:** Phase 0–2 behaviour/config decisions to avoid documenting transient state.
 - **Acceptance criteria:** unfamiliar developer follows docs from clean clone through build/tests/local start; no CRA/PostgreSQL/stale API claims.

docs/audits/verification-log.md

@@ -224,3 +224,4 @@ Output was reduced to filenames and commit counts. The token artifact appears un
 | V-190 | Compatible parser dependency resolution; Linux CPU hash lock; clean hash install; `pip-audit`; generated parser boundary tests; focused/full backend and sidecar suites; Docker daemon probe | Repository root / `tools/summarizer` | Remove reachable upload-parser advisories and close unsafe fallback/resource-boundary paths without parsing hostile fixtures | PASS/PARTIAL — FastAPI 0.141.1/Starlette 1.6.0, Pillow 12.3.0, pypdf 6.16.2 and python-multipart 0.0.32 resolve and install from hashes; upload-facing packages audit clear; parser 32/32, focused backend 51/51 and backend 719/719. Signature/container/page/pixel/decompression/output limits pass; backend binary fallback is removed and unexpected failures are sanitized | Docker daemon unavailable, so production image smoke/container assertions did not run. `pip-audit` reports 45 Torch/Transformers model-stack advisories tracked separately under JT-017. One Starlette/httpx test-client warning and five SWIG warnings remain | SEC-006 implemented locally; SEC-007 boundary work in progress, with child-process and container isolation still required |
 | V-191 | Real parser child extraction; minimal-environment probe; timeout/process-tree/capacity/stale-cleanup tests; `py_compile`; parser suite; Compose interpolation/control inspection | Repository root / `tools/summarizer` | Ensure untrusted document decode cannot consume the AI web process or inherit provider secrets and receives explicit runtime/container budgets | PASS/PARTIAL — parser 37/37 without warnings; TXT extraction executes in a child; provider/service secrets are absent; timeout kills parent and descendant; capacity recovers; stale cleanup preserves recent/unrelated paths. Compose resolves read-only root, `cap_drop: ALL`, no-new-privileges, 96 PIDs, 2 CPUs, 2 GiB memory, 768 MiB tmpfs and one model-cache volume | Windows proves deadline/process-tree behavior but cannot execute Linux `setrlimit`; Docker Desktop daemon is offline, so image build, non-root identity, inside-container rlimits and benign PDF/DOCX/image sizing remain unverified | SEC-007 repository boundary implemented; Linux/container/browser/production verification remains |
 | V-192 | Exact SDK resolution; generated API/test NuGet locks; locked restore; full backend; transitive NuGet vulnerability audit | Repository root | Make .NET toolchain and transitive package resolution reproducible and fail CI on dependency drift | PASS — SDK 9.0.317 selected by `global.json`; both lock files restore in locked mode; backend 719/719; NuGet reports no known vulnerable direct or transitive package | The first test attempt observed the deliberately started local API holding the apphost, then passed after shutdown; the clean rerun passed without warnings. CI action SHAs, image digests, installer hashing, SBOM and container scanning remain JT-017 work | .NET provenance gap closed; broader build provenance remains partial |
+| V-193 | Clean `npm ci`; lint; focused/full Jest; Next build/TypeScript; locked NuGet restores; full backend; stale-claim/path inspection | Repository root / `job-tracker-ui` | Rebuild current developer/operator documentation and prove its setup, quality and provider claims | PASS — install succeeds without the obsolete peer override; lint zero warnings; CV Builder 12/12 and frontend 64 suites/272 tests; optimized build/TypeScript; locked restores and backend 719/719; every documented path exists | User-local SDK 9.0.317 is shadowed by a runtime-only system host on this workstation, so backend proof invoked the installed host explicitly. No second clean machine or production rehearsal | JT-018 repository documentation complete; external operator rehearsal remains deployment evidence |

docs/verification/jt-018-developer-documentation.md

@@ -0,0 +1,30 @@
+# JT-018 developer and operator documentation verification
+
+## Implemented
+
+- Replaced the obsolete Create React App frontend guide with the actual Next.js 16, React 19, TypeScript, Jest, ESLint and Playwright workflow.
+- Corrected the root quickstart to use the committed npm and NuGet lock files (`npm ci` and `dotnet restore --locked-mode`).
+- Documented the separate normal-development (`3000`) and isolated Playwright (`3300`) frontend ports.
+- Removed the obsolete npm peer-dependency override and verified the current graph installs without it.
+- Corrected the production provider matrix: SQLite and MariaDB/MySQL are implemented; PostgreSQL is not.
+- Corrected the architecture inventory to React Router 7 and removed completed roadmap suggestions from the runtime README.
+- Linked environment, architecture, deployment, audit and programme sources so historical phase notes are not mistaken for current setup instructions.
+
+## Proof
+
+- Clean `npm ci`: passed without the removed `.npmrc` override and without lockfile drift.
+- Frontend lint: zero warnings.
+- Frontend Jest: 64/64 suites, 272/272 tests.
+- CV Builder autosave regression: 12/12 tests; timing-dependent manual-save assertions now verify the actual debounced autosave contract.
+- Next.js production build and integrated TypeScript check: passed.
+- API and test-project NuGet restore with `--locked-mode`: passed.
+- Backend: 719/719 tests passed on SDK 9.0.317.
+- Documentation stale-claim and referenced-path checks: passed; the only PostgreSQL mention explicitly states that it is unsupported.
+
+## Environment note
+
+SDK 9.0.317 is installed at the user-local `.dotnet` location. This workstation also has a runtime-only `C:\Program Files\dotnet` host earlier on `PATH`; verification therefore invoked the installed SDK host explicitly. The repository's `global.json` correctly rejects the runtime-only host instead of silently selecting a different SDK.
+
+## Remaining external proof
+
+A truly clean second machine and production operator rehearsal were not used. The documented install, lint, test, build and locked-restore commands were executed against a clean frontend dependency installation and the current repository checkout.

docs/work-programmes/master-progress.md

@@ -42,6 +42,7 @@ Updated: 2026-08-30
 - Localized the remaining active helper defaults in the admin SMTP test form, pasted-email importer, and image-crop alternative text.
 - Restored the local Python 3.12 toolchain and both virtual environments; the AI sidecar now passes 26/26 tests. Added a Next.js-compatible ESLint 9 flat configuration, strict zero-warning scripts, and a patched CommonJS-compatible `brace-expansion` override. The lint gate passes with zero findings and npm audit reports zero vulnerabilities.
 - Pinned the repository to .NET SDK 9.0.317, generated content-hashed transitive NuGet locks for the API and test project, and made CI restores fail on lock drift. Locked restore and backend 719/719 pass; the current NuGet graph has no known vulnerable packages.
+- Rebuilt the active developer/operator documentation around the actual Next.js 16/.NET 9 application, replaced CRA and `npm start` guidance, separated normal and Playwright ports, corrected React Router 7 and the SQLite/MariaDB provider matrix, removed the obsolete npm peer override, and verified the documented clean install, lint, test, build and locked-restore commands.
 
 ### In progress
 
@@ -110,7 +111,7 @@ Updated: 2026-08-30
 - Manual desktop browser review: webpack development server rendered the new Career navigation and Overview correctly in dark mode; API-dependent profile status remained unavailable because the backend was not running for that isolated UI review.
 
 - **Overall programme status:** Active but externally blocked. Eight packages are locally verified and twenty-seven are implemented with verification incomplete. The prioritized admin-only version indicator, every immediate repository/browser item, SEC-006/SEC-007 repository boundaries, SEC-009, the PROD-001 read-only inventory, and the PROD-003 safe benchmark harness are complete on the feature branch.
-- **Current work package:** JT-017/JT-018 supply-chain and developer-documentation hardening while external runtime gates remain blocked.
+- **Current work package:** JT-017 remaining immutable CI/image/scanner provenance and JT-019 schema-ownership inventory while external runtime gates remain blocked. JT-018 is complete in repository scope.
 - **Completed work packages:** None are `DONE`; all repository security/AI packages still have applicable browser, provider and/or production gates.
 - **Locally verified work:** SEC-001, SEC-002, SEC-003, SEC-005A, CORE-001, PROD-002, DEP-001 and VER-001 (`VERIFIED LOCALLY`).
 - **Implemented, verification incomplete:** SEC-004, SEC-005B, SEC-006, SEC-007, SEC-008, SEC-009, CORE-002, BG-001, OPS-001A/B/C, POL-001/002, AI-001/002/003/004, UX-001/002/003, QA-001, CAREER-001/002, MAIL-001, JOBS-001/002 and PRODUCT-001 (`IMPLEMENTED — NOT VERIFIED`). Their safe repository/browser scope is implemented; production/native-device/provider/retention gates remain where recorded.