docs: reorganize tree, restore architecture + research from archive, add Phase 0 reports

Active docs/ was stub scaffolding while the real docs sat in docs/_archive/.
Restore and correct them, and record the Phase 0 work.

- docs/architecture/current.md: verified system map (from archived SYSTEM_OVERVIEW,
  9 corrections against code).
- docs/research/competitors.md: sourced competitor analysis (from archived
  PRODUCT_RESEARCH, feature matrix corrected).
- docs/decisions/ADR-002-job-application-model.md: the Job/JobApplication split.
- docs/application-discovery-report.md, docs/implementation-roadmap.md,
  docs/phase-0-foundation-report.md, docs/career-workspace-branch-assessment.md.
- Remove 10 zero-byte placeholder files that advertised content that never existed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/security/ai-security.md

@@ -0,0 +1,35 @@
+# AI Security
+
+## Purpose
+
+Protect against AI-related risks.
+
+---
+
+# Prompt Injection
+
+Untrusted content:
+
+- Job descriptions.
+- Uploaded CVs.
+- Emails.
+
+must not control AI behaviour.
+
+---
+
+# AI Output Validation
+
+Check:
+
+- Unsupported claims.
+- Dangerous content.
+- Formatting issues.
+
+---
+
+# Data Handling
+
+Only send required information.
+
+Avoid unnecessary exposure.

docs/security/api-security.md

@@ -0,0 +1,40 @@
+# API Security
+
+## Requirements
+
+All APIs must:
+
+- Authenticate correctly.
+- Validate input.
+- Return safe errors.
+
+---
+
+# Rate Limiting
+
+Protect:
+
+- Login.
+- AI endpoints.
+- File uploads.
+- Public CV pages.
+
+---
+
+# API Keys
+
+Admin-only.
+
+Never expose:
+
+- Provider keys.
+- Secrets.
+- Tokens.
+
+---
+
+# External APIs
+
+Validate responses.
+
+Do not trust third-party data.

docs/security/authentication.md

@@ -0,0 +1,84 @@
+# Authentication
+
+## Purpose
+
+Define user login and registration.
+
+---
+
+# Supported Methods
+
+Users should be able to:
+
+## Email Registration
+
+Create account using:
+
+- Email.
+- Password.
+- Confirmation.
+
+---
+
+## OAuth Registration/Login
+
+Support:
+
+- Google.
+- Microsoft.
+
+---
+
+# Expected Behaviour
+
+If OAuth user does not exist:
+
+Create account automatically.
+
+Example:
+
+User clicks:
+
+"Continue with Google"
+
+↓
+
+Authenticate
+
+↓
+
+No account exists
+
+↓
+
+Create account
+
+↓
+
+Login
+
+---
+
+# Password Requirements
+
+Support:
+
+- Secure hashing.
+- Password reset.
+- Password change.
+
+---
+
+# Authentication UX
+
+Users should have:
+
+- Clear errors.
+- Loading states.
+- Recovery options.
+
+Avoid:
+
+"Authentication failed"
+
+without explanation.

docs/security/authorization.md

@@ -0,0 +1,43 @@
+# Authorization
+
+## Purpose
+
+Control access to resources.
+
+---
+
+# User Isolation
+
+A user must only access:
+
+- Their jobs.
+- Their CV.
+- Their files.
+- Their emails.
+- Their settings.
+
+---
+
+# Admin Role
+
+Admins may access:
+
+- System settings.
+- Provider configuration.
+- Monitoring.
+
+---
+
+# API Rules
+
+Every protected endpoint must verify:
+
+1. User identity.
+2. User permission.
+3. Resource ownership.
+
+---
+
+# Never Trust Frontend
+
+The backend must enforce permissions.

docs/security/file-security.md

@@ -0,0 +1,56 @@
+# File Security
+
+## Purpose
+
+Protect uploaded documents.
+
+---
+
+# File Types
+
+Potential uploads:
+
+- PDF.
+- DOCX.
+- Images.
+- Portfolio files.
+
+---
+
+# Validation
+
+Check:
+
+- File type.
+- File size.
+- File contents.
+
+Never trust extensions.
+
+---
+
+# Processing
+
+Uploaded files may contain:
+
+- Malicious content.
+- Embedded scripts.
+- AI prompt injection.
+
+Treat as untrusted.
+
+---
+
+# Storage
+
+Requirements:
+
+- Secure naming.
+- Access control.
+- User ownership checks.
+
+---
+
+# PDF Processing
+
+Never directly trust extracted text.

docs/security/input-validation.md

@@ -0,0 +1,48 @@
+# Input Validation
+
+## Purpose
+
+Protect the application.
+
+---
+
+# Validate
+
+All inputs:
+
+- Forms.
+- APIs.
+- Imports.
+- Files.
+- AI outputs.
+
+---
+
+# Protection Against
+
+Examples:
+
+- SQL injection.
+- XSS.
+- HTML injection.
+- Malicious uploads.
+
+---
+
+# CV Builder
+
+Special attention:
+
+Users can create:
+
+- Custom sections.
+- HTML-like content.
+- Formatting.
+
+The renderer must sanitise content.
+
+---
+
+# Rule
+
+Never render user content directly without validation.

docs/security/overview.md

@@ -0,0 +1,64 @@
+# Security Overview
+
+## Purpose
+
+Define security requirements for Jobjakt.
+
+The application stores sensitive career information including:
+
+- CVs.
+- Employment history.
+- Personal details.
+- Job applications.
+- Documents.
+- Communication.
+
+Security must be considered a core product requirement.
+
+---
+
+# Security Goals
+
+Jobjakt should provide:
+
+- Secure authentication.
+- Strong user separation.
+- Safe document handling.
+- Protected APIs.
+- Secure AI integrations.
+
+---
+
+# Security Principles
+
+## Least Privilege
+
+Users should only access their own data.
+
+Admins have additional permissions.
+
+---
+
+## Secure By Default
+
+Features should default to safe behaviour.
+
+---
+
+## Validate Everything
+
+All external input should be considered untrusted.
+
+Sources:
+
+- Forms.
+- APIs.
+- Uploaded files.
+- AI responses.
+- Imported job descriptions.
+
+---
+
+## Do Not Over-Engineer
+
+Security should protect users without harming usability.

docs/security/privacy.md

@@ -0,0 +1,51 @@
+# Privacy
+
+## Principles
+
+Users own their information.
+
+---
+
+# Requirements
+
+Support:
+
+- Data deletion.
+- Export.
+- Consent.
+
+---
+
+# Public CV
+
+Users choose:
+
+Enabled.
+
+Disabled.
+
+---
+
+# Public URLs
+
+Use:
+
+Random UUID.
+
+Example:
+
+/cv/8a92f3e2-xxxx
+
+Avoid:
+
+Predictable usernames.
+
+---
+
+# Future SaaS
+
+Consider:
+
+- Privacy policy.
+- GDPR compliance.
+- Data processing agreements.

docs/security/saas-security.md

@@ -0,0 +1,51 @@
+# SaaS Security
+
+## Future Requirements
+
+When moving to SaaS:
+
+Support:
+
+- Multiple users.
+- Subscription plans.
+- Usage limits.
+
+---
+
+# Tenant Isolation
+
+Every resource belongs to:
+
+User
+
+or
+
+Organisation.
+
+---
+
+# Billing Security
+
+Never trust client-side:
+
+- Subscription status.
+- Permissions.
+- Limits.
+
+Verify server-side.
+
+---
+
+# Admin Features
+
+Protect:
+
+- User management.
+- AI providers.
+- System settings.
+
+---
+
+# Principle
+
+Prepare architecture without adding unnecessary complexity early.

docs/security/two-factor-authentication.md

@@ -0,0 +1,82 @@
+# Two Factor Authentication
+
+## Purpose
+
+Provide additional account protection.
+
+---
+
+# Preferred Method
+
+TOTP authentication.
+
+Compatible with:
+
+- Google Authenticator.
+- Microsoft Authenticator.
+- Authy.
+
+---
+
+# Flow
+
+Enable 2FA:
+
+User requests setup
+
+↓
+
+Generate secret
+
+↓
+
+Display QR code
+
+↓
+
+User scans
+
+↓
+
+User confirms code
+
+↓
+
+Enable 2FA
+
+---
+
+# Login Flow
+
+Password/OAuth
+
+↓
+
+Request authenticator code
+
+↓
+
+Validate
+
+↓
+
+Login
+
+---
+
+# Recovery
+
+Support:
+
+- Backup codes.
+- Disable/reset through account recovery.
+
+---
+
+# UX Requirements
+
+Explain clearly:
+
+- Why enable 2FA.
+- How it works.
+- Recovery options.

docs/security/uploads.md

@@ -0,0 +1,3 @@
+# uploads
+
+TODO: Complete documentation.

docs/security/user-data.md

@@ -0,0 +1,48 @@
+# User Data Protection
+
+## Purpose
+
+Protect personal career information.
+
+---
+
+# Stored Data
+
+Potential sensitive information:
+
+- CV content.
+- Employment history.
+- Contact information.
+- Documents.
+- Email communication.
+
+---
+
+# Requirements
+
+Support:
+
+- User export.
+- User deletion.
+- Data ownership.
+
+---
+
+# Database
+
+Ensure:
+
+- Correct relationships.
+- No cross-user queries.
+- Safe migrations.
+
+---
+
+# Logging
+
+Never log:
+
+- Passwords.
+- Tokens.
+- Private documents.
+- Sensitive CV content.

docs/security/validation.md

@@ -0,0 +1,3 @@
+# validation
+
+TODO: Complete documentation.