chore(ai): migrate to dual-agent handoff system

Split the monolithic CLAUDE.md into a durable handoff system:

- .ai/PROJECT_CONTEXT.md  — stable architectural truth (stack, structure,
  SaaS shape, ConnectWise, coding standards, frontend patterns, critical
  lessons). Ported verbatim from the previous CLAUDE.md.
- .ai/CURRENT_TASK.md     — single active task with DoD + out-of-scope.
- .ai/HANDOFF.md          — resume point, kept under ~2K tokens.
- .ai/TODO.md             — backlog, read only when CURRENT_TASK complete.
- .ai/DECISIONS.md        — append-only architectural decision log.
- .ai/SESSION_LOG.md      — append-only chronological history.
- .ai/README.md           — human-facing explanation of the system.

Root agent files share a byte-identical protocol block (verified via diff):

- CLAUDE.md — primary agent, with GitNexus + gstack tooling and the
  Claude Opus 4.7 co-author trailer.
- AGENTS.md — OpenAI Codex resume agent, with grep/rg fallbacks and the
  Codex co-author trailer. Steps in when Claude hits session/weekly
  limits.

Legacy root-level SESSION-HANDOFF.md deleted — superseded by .ai/HANDOFF.md.
It was a self-describing one-off from the Design System v4 migration and
had no external references.

Supersedes previous CLAUDE.md. Old version recoverable via
`git show pre-ai-handoff:CLAUDE.md` (tag points at commit e110fed).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.ai/CURRENT_TASK.md

@@ -0,0 +1,23 @@
+# CURRENT_TASK.md
+
+<!-- EXAMPLE — replace on first real task -->
+
+**Task:** One-sentence goal describing what this task accomplishes.
+
+**Status:** not-started
+
+**Definition of Done:**
+- [ ] Testable criterion 1 (e.g., "endpoint returns 200 with expected payload shape")
+- [ ] Testable criterion 2 (e.g., "frontend displays new field without layout regression")
+- [ ] Tests added or updated
+- [ ] `npm run build` passes (frontend) / `pytest` passes (backend)
+
+**Assumptions:**
+- What we're treating as given (e.g., "existing auth middleware handles this case")
+- Constraints inherited from surrounding work
+
+**Out of scope:**
+- What this task explicitly does NOT cover (prevents scope creep across handoffs)
+- Adjacent work that belongs in a separate task
+
+<!-- END EXAMPLE -->