docs: record approved website redesign plan

tasks/evidence/2026-09-24/.gitignore

@@ -0,0 +1 @@
+__pycache__/

tasks/evidence/2026-09-24/local-replay.md

@@ -0,0 +1,29 @@
+# Bundle 0 isolated local replay
+
+Replayed 2026-09-24 to 2026-09-25 with a local Redis container on `127.0.0.1:6379`, Django `config.settings.test` using the ignored SQLite `db.test.sqlite3`, Next.js dev server, and Playwright Chromium. No production database, payment gateway, SMS provider, or email service was used. The disposable data came from `create-local-baseline-fixtures.py`; the payment and OTP scripts in this directory mock external side effects.
+
+## Replayed paths
+
+| Journey | Happy path observed | Failure path observed |
+| --- | --- | --- |
+| Authentication | Browser: existing mobile `09198000111` → password login → profile. Isolated API: new mobile OTP verification → signup → OTP login → password reset → login with new password. | Browser stayed in auth for invalid mobile/wrong password. Isolated API rejected invalid OTP request, incorrect code, duplicate registration, and the old password after reset. |
+| Events | Browser: published events list and detail; signed-in free registration reached the success page with confirmed status and event details. | Full event had a disabled registration button and zero remaining capacity. Anonymous free registration redirected to auth. |
+| Payment | Mocked Django client: gateway request produced a pending payment; successful callback marked payment paid and registration confirmed. Browser payment result rendered the paid event, amount, and reference ID. | Mocked gateway outage returned 502 without a persisted payment; canceled callback redirected to failed state; duplicate paid attempt returned 400. Browser rendered the failed payment result. |
+| Blog | Browser opened the published fixture article with reading content, author, and comments area. Staff blog list showed the published article. | Missing article slug rendered the site's not-found view. |
+| Staff admin | Browser login as isolated staff; event list displayed fixture events and registration count. Editing the free-event title saved and the API returned the new value. At 390px the staff event list switched to cards and the menu exposed the blog route. | Empty required event title disabled Save. The earlier anonymous `/admin` replay redirected away. |
+
+The staff-edited fixture title was restored after verification. These fixtures live only in the ignored SQLite test file. The mocked payment success is not proof of a live gateway checkout, and the mocked OTP replay is not proof of SMS delivery or the Google OAuth path.
+
+## Backend test baseline (historical run)
+
+- `python manage.py check --settings=config.settings.test`: passed, zero issues.
+- `python manage.py test apps.events.tests.integration.test_events --settings=config.settings.test --noinput`: **25 passed**.
+- `python manage.py test apps.users.tests apps.events.tests apps.payments.tests --settings=config.settings.test --noinput`: **148 tests ran, 89 errors**. Raw output: [backend-focused-tests.txt](backend-focused-tests.txt). These errors were recorded as stale tests at the time. The current pytest rerun and results are in [test-rerun-2026-09-26.md](test-rerun-2026-09-26.md) and supersede this as the current suite status. No application business logic was changed to make the historical expectations pass.
+
+## Runtime observations to carry forward
+
+- Event detail's second-by-second countdown produced a server/client text mismatch and React hydration warning in the dev browser.
+- The signed-in browser requested `/api/notifications/stream-token` and received HTTP 405.
+- The old footer still shows the unselected contact variants. The selected About-page contacts are recorded in the content inventory and design contract for cutover.
+
+The browser replay covers the principal local auth, event, payment-result, blog-reading, and staff-edit journeys with a failure case in each. Full SMS transport, Google OAuth, and a live payment gateway need separate integration work. This file records the starting behavior; it is not approval of those external integrations or of the CMS/API contract.

tasks/evidence/2026-09-24/test-rerun-2026-09-26.md

@@ -0,0 +1,12 @@
+# Backend test rerun — 2026-09-26
+
+Reran the repository's documented pytest suites from `guilan-ace-backend` with `.venv/Scripts/python.exe` and `config.settings.test` from `pytest.ini`.
+
+| Command | Result |
+| --- | --- |
+| `.venv/Scripts/python.exe -m pytest -m unit` | 79 passed, 158 deselected, 3.80s |
+| `.venv/Scripts/python.exe -m pytest -m integration` | 158 passed, 79 deselected, 17.58s |
+
+Together, all 237 collected pytest tests passed. The integration run included users, events, payments, notifications, blog, and other app integration tests. No external SMS delivery, Google OAuth provider, or live payment gateway was exercised.
+
+The previous `manage.py test apps.users.tests apps.events.tests apps.payments.tests --settings=config.settings.test` command discovered zero tests because the current suites are organized and marked for pytest. Its `NO TESTS RAN` result is not a passing test result; use the pytest commands above.