docs: consolidate repository guides and preserve audit history

docs/testing/README.md

@@ -0,0 +1,8 @@
+# Testing and quality gates
+
+The repository has backend xUnit tests, frontend Jest/React Testing Library tests, Python pytest tests, and Playwright browser suites. Use isolated data and never bypass authentication or external-provider gates in order to make a test green.
+
+- [Backend tests](backend.md)
+- [Frontend tests](frontend.md)
+- [Browser tests](browser.md)
+- [Security tests](security.md)

docs/testing/backend.md

@@ -0,0 +1,9 @@
+# Backend tests
+
+From the repository root:
+
+```powershell
+dotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --no-restore
+```
+
+The suite covers controllers, ownership/tenancy, authentication, migrations/provider parity, file/parser boundaries, background work, AI policy, and integrations with synthetic data. Migration tests use disposable databases; they do not prove a production upgrade or restore.

docs/testing/browser.md

@@ -0,0 +1,5 @@
+# Browser tests
+
+Install Chromium once with `npx playwright install chromium`, then run `npm run test:e2e` from `job-tracker-ui/`. The harness starts isolated API/SQLite and frontend services, normally on ports 5302 and 3300. PDF and rate-limit suites use their dedicated configs.
+
+The browser suite covers authentication, job creation/workspace, Career Workspace, public CV/PDF access, and selected accessibility/security flows. A passing local suite is not proof of live OAuth, SMTP, payment, proxy, restore, or production network behavior.

docs/testing/frontend.md

@@ -0,0 +1,13 @@
+# Frontend tests
+
+From `job-tracker-ui/`:
+
+```powershell
+npm ci
+npm run lint
+npm test -- --runInBand
+npm run typecheck
+npm run build
+```
+
+Keep the strict TypeScript/lint/build gates enabled. Unit tests should preserve translated labels, draft state, modal focus, and authenticated ownership behavior when UI components change.

docs/testing/security.md

@@ -0,0 +1,5 @@
+# Security tests
+
+Security-focused tests cover owner isolation, authorization replay/session state, SSRF/import boundaries, file/parser limits, AI sidecar authentication, PDF admission, rate limits, dependency checks, and sensitive-output handling. Keep hostile fixtures synthetic and use the repository's existing scripts/configs.
+
+The dated audit evidence under the archive records what was and was not exercised. Manual production checks remain gates where local fixtures cannot establish the claim.