docs: archive gemini session and hand over to claude for security audit

dev_docs/SESSION_STATE.md

@@ -1,18 +1,20 @@
 # CURRENT AI WORKING SESSION
 
-**Active AI:** Antigravity (Gemini)
+**Active AI:** Claude (Pending Handover)
 **Last Updated:** 2026-04-11
-**Current Version:** v1.3.0
+**Current Version:** v1.3.5
 **Branch:** dev
 
 ### Current Status
-Finalized the system refactoring by implementing a complete, portable **Dockerization Architecture**. Introduced the `export_prod.sh` bundle compiler, centralized technical documentation into a Single Source Of Truth (`PROJECT_ARCHITECTURE.md`), and ensured exact reverse compatibility so that bare-metal development using `./start_server.sh` operates identically to previous versions.
+**Security Audit Phase.** The application infrastructure has been successfully stabilized and documented (Dockerized, Standalone Systemd, LDAP integrated, Offline Dexie.js active). 
+The next explicit objective is to run a deep security and vulnerability sweep before full production deployment.
 
 ### Technical Context
-- **Persistence Mapping:** Local database (`inventory.db`) and `ldap_config.json` now persist through the environmental variable `DATA_DIR` (mapped to local `/data` volume).
-- **Log System:** Created `backend/logger.py` with Python's RotatingFileHandler. Streamed locally into `/logs`. 
-- **Standalone:** Next.js uses `output: standalone` configuration specifically to support the Node alpine dockerfile. Caddy replaces `local-ssl-proxy` only inside the Docker environment.
+- A full security audit mapping is prepared in `dev_docs/SECURITY_AUDIT_PLAN.md`.
+- See `AI_RULES.md` for strict boundaries on editing documentation and git commit formats.
 
-### Next Steps / Blockers
-1. Testing actual AI flow in production mode (using the exported Production Bundle zip).
-2. Implementing the Advanced Audit log Dashboard inside the UI.
+### Next Steps / Blockers (For CLAUDE)
+1. Read `dev_docs/SECURITY_AUDIT_PLAN.md`.
+2. Execute the security checks across the Backend (FastAPI) and Frontend (Next.js/Dexie) surfaces.
+3. Generate a `SECURITY_REPORT.md` artifact/document in `dev_docs/`.
+4. Directly patch any critical vulnerabilities found during the audit (e.g. JWT enforcement, SQL validation, Offline payload sanitation) and commit them safely.