docs(remaster): full-system audit + rebuild-vs-refactor decision

Deep, code-grounded audit of Job Tracker producing the mission deliverables
under docs/remaster/: system audit, bug report, architecture/data-model/AI/UX
reviews, remaster proposal, migration plan, competitor research, and the gated
REBUILD_DECISION.

Verdict: Incremental Refactor (no full rebuild). Evidence: no Critical defects;
hardened cookie/CSRF auth (token never in JS storage), real SSRF defence,
enforced multi-tenancy via global query filters, decoupled provider-swappable
AI service, 135 backend tests. Debt is localised (god controllers/entity,
missing hot-path indexes, prompt-injection hardening, CRA build debt) and
reachable by in-place, test-guarded refactors.

Also harden .gitignore: exclude agent tooling (.claude/, .bg-shell/, .agent.md)
and restore/broaden the runtime-secrets block (**/keys/, **/backups/, exports,
CV artifacts) so nested DataProtection keys can't be committed accidentally.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -46,6 +46,16 @@ todo jobtracker.txt
 tmp/
 /tmp/
 
+# Runtime data that must never be committed (DataProtection keys, exports, CV artifacts)
+keys/
+**/keys/
+backups/
+**/backups/
+JobTrackerApi/exports/
+JobTrackerApi/CvArtifacts/
+JobTrackerApi/CvExports/
+JobTrackerApi/CvBenchmarks/
+
 # Local app data
 *.db
 *.db-*
@@ -60,6 +70,11 @@ target/
 *~
 *.code-workspace
 
+# Agent tooling — must never be committed
+.claude/
+.bg-shell/
+.agent.md
+
 # GSD
 .gsd