docs(ai): handoff for Codex — CI recovery + 54 real backend failures

Updates HANDOFF.md, CURRENT_TASK.md, and SESSION_LOG.md so the next
session has accurate resume state. Summary of where things are:

- PR #141 (PSA tickets), PR #147 (FlowPilot Phase 1-9), PR #148 (CI
  fixes part 1), PR #149 (CI fixes part 2) all merged to main in this
  session.
- Branch protection enabled on main: PR-only, CI / frontend required.
- PR #150 (this branch) is the last CI-config PR — adds
  DATABASE_TEST_URL to the workflow and pins upload-artifact to v3.
- Next session: watch #150's CI, merge if green, add CI / backend to
  required checks, then start on the 54 real backend test failures.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.ai/CURRENT_TASK.md

@@ -1,33 +1,22 @@
 # CURRENT_TASK.md
 
-**Task:** none — replace this file when starting the next real task.
+**Task:** Restore a fully green CI gate on `main` and lock it via branch protection so future merges can't introduce silent rot.
 
-**Status:** not-started
-
-**Definition of Done:** n/a
-
-**Assumptions:** n/a
-
-**Out of scope:** n/a
-
----
-
-<!-- When you start a real task, replace the block above with:
-
-**Task:** One-sentence goal.
-
-**Status:** not-started | in-progress | blocked | ready-for-review | complete
+**Status:** in-progress
 
 **Definition of Done:**
-- [ ] Testable criterion 1
-- [ ] Testable criterion 2
-- [ ] Tests added or updated
-- [ ] `npm run build` passes (frontend) / `pytest` passes (backend)
+- [ ] PR #150 (`fix/ci-workflow-config`) merged. Both `CI / backend (pull_request)` and `CI / frontend (pull_request)` show success on the merge commit.
+- [ ] `CI / backend (pull_request)` added to required status checks on `main` in Gitea branch protection (frontend is already required).
+- [ ] The 54 real backend test failures (left after #149's infra cleanup) categorized and fixed in a follow-up PR. Target: 0 failures, 0 errors on a `pytest` run inside `resolutionflow_backend`.
+- [ ] `npm run lint` stays at 0 errors after the cleanup PR (already at 0 on main).
+- [ ] Append a SESSION_LOG.md entry summarizing what shipped.
 
 **Assumptions:**
-- What we're treating as given
+- The 54 failures fall into a small number of root-cause categories (likely 3–5: fixture-scoping leaks, DB cleanup ordering, account_id propagation in test seed paths). Verify before assuming.
+- The pytest-asyncio 0.24 + pytest 8.4 toolchain bumped in #149 is the right baseline; do not revert.
+- `DATABASE_TEST_URL` is the only DB URL conftest will honor; do not weaken the safety guard added in `dab740d`.
 
 **Out of scope:**
-- What this task explicitly does NOT cover
-
--->
+- New feature work on FlowPilot (Phase 10+) or PSA — keep this branch focused on CI debt.
+- Frontend lint warnings (23 remain after #149; they're missing-deps in useEffect, opt-in cleanup later).
+- RLS test suite (`test_rls_isolation.py`) — gated behind `RUN_RLS_TESTS=1` and not in the default CI run.