chore: bootstrap project (sprint 0)

Lay down the project foundation before Sprint 1 implementation:

- SPEC.md enriched with a "Décisions techniques" section that pins
  down 3-role auth (admin super-user / redteam / soc), JWT bearer,
  single-container Flask+React topology, minimal Engagement model,
  local MITRE STIX bundle, and the Makefile target list.
- .claude/agents/ defines the 6 sub-agents per SPEC.md § Team:
  backend-builder, frontend-builder, spec-reviewer (project override
  covering plan-vs-spec + code-vs-spec), code-reviewer, test-verifier,
  devil-advocate.
- tasks/todo.md holds the full Sprint 1 plan (Auth + CRUD Engagement)
  validated by spec-reviewer on 2026-05-26 after one round of fixes.
- CHANGELOG.md and tasks/lessons.md scaffolded.
- .gitignore covers Python, Node, Playwright, secrets, build artifacts
  and Claude Code worktrees.

No application code is shipped in this commit — Sprint 1 will be a
separate branch and PR.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,91 @@
+# --- Claude Code worktrees (never commit) ---
+.claude/worktrees/
+
+# --- Secrets & env ---
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+credentials*
+secrets*
+
+# --- Python ---
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# Virtual envs
+.venv/
+venv/
+env/
+ENV/
+
+# pytest / coverage / mypy / ruff
+.pytest_cache/
+.coverage
+.coverage.*
+htmlcov/
+.cache
+.tox/
+.nox/
+.mypy_cache/
+.ruff_cache/
+
+# SQLite local dbs
+*.sqlite
+*.sqlite3
+*.db
+
+# --- Node / Frontend ---
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+.pnpm-store/
+
+# Vite / build outputs
+frontend/dist/
+frontend/.vite/
+*.local
+
+# --- Playwright ---
+e2e/test-results/
+e2e/playwright-report/
+e2e/playwright/.cache/
+
+# --- Editors / OS ---
+.vscode/
+.idea/
+*.swp
+*.swo
+.DS_Store
+Thumbs.db
+
+# --- Docker ---
+*.pid
+
+# --- Build artifacts / payloads (per CLAUDE.md OPSEC) ---
+*.exe
+*.dll
+*.bin
+*.o
+*.obj
+*.exp
+*.lib
+
+# --- MITRE bundle if huge (kept by default — uncomment to ignore) ---
+# backend/data/mitre/enterprise-attack.json